
UNSOLVED
G
GolfDoggie
3 Posts
0
1768
September 20th, 2004 14:00
HiJackThis LogFile Help
I need help with deleting files from Hijackthis, if someone could direct me through the steps.
Thanks for your help
Here's my logfile:
Logfile of HijackThis v1.97.7
Scan saved at 11:46:13 AM, on 9/20/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.51 SP2 (5.51.4807.2300)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\GEARSEC.EXE
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\netis32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\Common Files\WinTools\WToolsS.exe
C:\Program Files\VNC\WinVNC\WinVNC.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\RunDll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINNT\System32\P2P Networking\P2P Networking.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\program files\accessories\quicktime65\qttask.exe
C:\WINNT\nettb32.exe
C:\WINNT\System32\ljxxadyv.exe
C:\Program Files\Web_Rebates\WebRebates0.exe
C:\Program Files\CashBack\bin\cashback.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\NaviSearch\bin\nls.exe
C:\Program Files\Jornada 720\Microsoft ActiveSync\WCESCOMM.EXE
C:\PROGRA~1\Web Offer\wo.exe
C:\WINNT\System32\odbcji32.exe
C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
C:\Program Files\Common Files\WinTools\WSup.exe
C:\Program Files\Web_Rebates\WebRebates1.exe
C:\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.begin2search.com/googlesidesearch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch.com/ie.aspx?tb_id=50168
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\uruwi.dll/sp.html#37680
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\uruwi.dll/sp.html#37680
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\uruwi.dll/sp.html#37680
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\uruwi.dll/sp.html#37680
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\system32\uruwi.dll/sp.html#37680
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50168
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.google.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50168
R3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - C:\Program Files\TV Media\TvmBho.dll
O2 - BHO: (no name) - {0426033A-531F-B9CF-FD2A-16A9B7B9127B} - C:\WINNT\sdkvd.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\VNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [P2P Networking] C:\WINNT\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\program files\accessories\quicktime65\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nettb32.exe] C:\WINNT\nettb32.exe
O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKLM\..\Run: [zaywqrwrneema] C:\WINNT\System32\ljxxadyv.exe
O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [CashBack] C:\Program Files\CashBack\bin\cashback.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKCU\..\Run: [Fomine WinPopup] C:\Program Files\Fomine WinPopup\WinPopup.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Jornada 720\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Mmgsvc] C:\WINNT\mmgsvc.exe
O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
O4 - HKCU\..\Run: [dsctl] C:\WINNT\System32\dsctl.exe
O4 - HKCU\..\Run: [odbcji32] C:\WINNT\System32\odbcji32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O9 - Extra button: SideFind (HKLM)
O9 - Extra button: Create Mobile Favorite (HKLM)
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: PartyPoker.com (HKLM)
O9 - Extra 'Tools' menuitem: PartyPoker.com (HKLM)
O9 - Extra button: Royal Vegas Poker (HKLM)
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt1_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {33288993-5664-11D4-8B5B-00D0B73B3518} (ell Class) - http://www.easports.com/downloads/games/common/ieell.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.apple.com/saba/us/win/QuickTimeInstaller.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://register3.valueactive.com/mpp_229/webolr/OCX/FlashAX.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EB66E3BF-CF73-47A1-8D8B-BDA9382EDEDB}: NameServer = 192.168.1.1
Responses (1)
Solutions (0)

jamez kann
2 Intern
•
860 Posts
119
0
Posted September 20th, 2004 16:00
The presence of bulk parasites can make it very difficult to detect critical symptoms of major infections. We need to clear them out first. Please co-operate when asked to run Spybot . We have to create a level playing field to work with. Get them here:
Download Spybot Search and Destroy from www.spybot.info.or http://www.safer-networking.org/en/mirrors/index.html Once downloaded, install it and choose the appropriate language. Before running a full system scan it is crucial that you update Spybot’s database for additions of known threats, this increases your chances of solving your problem. Once it has updated run a full system scan and fix anthing in red.
Tutotials on how To Install Spybot Search and Destroy
http://tomcoyote.org/SPYBOT/index1.php
http://www.bleepingcomputer.com/forums/tutorial43.html
Run Cwshredder http://www.majorgeeks.com/download4086.html
CWShredder Tutorial - How to remove CoolWebSearch with CWShredder
http://www.bleepingcomputer.com/forums/tutorial47.html
AboutBuster removes the HomeSearch Assistant. How you know you have it. Bogus Spyware PopUps on Internet Explorer startup Homepage hijacked to res://random .dll/random.
How did my homepage get set to res://random.dll/index.html#96676 or something similar?
http://www.pchell.com/support/onlythebest.shtml
http://www.malwarebytes.biz/forums/index.php?showtopic=188
About:Blank fix
http://www.malwarebytes.biz/forums/index.php?showtopic=97
How to use AboutBuster. Download AboutBuster 2.0 from the Downloads link. Then unzip all files from the zip folder to a folder or your desktop. Start it and hit ok. Then hit update. A new screen should popup. On that screen hit Check for Updates. If it says it found an update hit Download Updates. If it doesnt it will automatically tell you and exit. Now for the scanning part. Hit start and then Ok. The program should start scanning. Then hit exit and reboot. Once rebooted run AboutBuster 2.0 once more to make sure everything is ok. The database will be updated very frequently so check your versions once a day.
Run http://www.majorgeeks.com/download4289.html about:buster
About:Blank A thing of the past (we hope)
http://www.zerosrealm.com/forums/index.php?showtopic=107
Wtools
http://www.pchell.com/support/wintools.shtml
http://sarc.com/avcenter/venc/data/pf/adware.huntbar.html
http://inetexplorer.mvps.org/data/wtoolsa.htm
If the above fixes fail you would need to run hijackthis
Here are some sites where you can receive help analyzing your HijackThis log from trained experts. Note that the sites require registration before you will be able to post.
Include your Hijackthis log in the post while explaining your problem at the same time.
http://radiosplace.com/
http://tomcoyote.com/hjt/#copyandpaste
Online Tools Resources
You can find almost everything here :) http://forums.subratam.org/index.php?showtopic=43
http://computercops.biz/downloads-cat-14.html
http://encyclopedia.thefreedictionary.com/Online%20Tools%20Resources
http://www.geekstogo.com/forum/index.php?showtopic=38
http://www.windowsbbs.com/showthread.php?t=31695
http://aumha.org/secure.htm
Kill Spyware Forums
http://forums.subratam.org/index.php?showforum=7
tools needed to get help http://forums.subratam.org/index.php?showtopic=7
Forum Led by: Forum Moderators,subratam,baskar1234(DELL REGULAR),efwis,Metallica,psyne, SpyDie, normmork, Admin,chrisRLG(DELL REGULAR)
pcpitstop Viruses, Spyware, AdwareHijackThis Logs
http://pcpitstop.ibforums.com/index.php?showforum=25
malwarebytes
http://www.malwarebytes.biz/forums/index.php?showforum=5
groovicus
networktechsupport
http://networktechsupport.com/forums/index.php?showforum=20
Forum Led by: Kat
thatcomputerguy Virus and Spyware/Adware/Malware Issues
http://forums.thatcomputerguy.us/index.php?showforum=39
Forum Led by: Searcher, Matrix420, Forum Moderator
spywarewarrior
http://spywarewarrior.com/viewforum.php?f=5
Moderators suzi, Mods, Experts, Distinguished Experts
karlsforums Virus Help and Discussion Forum
http://www.karlsforums.com/forums/forumdisplay.php?fid=68
windowsforum Hijack This and Spyware Removal Support
http://www.windowsforum.org/forum/index.php?showforum=53
http://www.zerosrealm.com/forums/index.php?showforum=4
Zero,Lopus,
Read this first!
http://www.zerosrealm.com/forums/index.php?showtopic=17
http://amazingtechs.com/index.php?act=idx
Forum Led by: discogail, bistro, njustice
http://pctorium.com/forum/index.php?showforum=30
njustice
geekstogo
http://www.geekstogo.com/forum/index.php?showforum=37
http://forums.techguy.org/
$teve ,flrman1,Rollin' Rog ,whz ,Davey7549
http://smartercomputing.ipbhost.com/index.php?showforum=95
http://forum.aumha.org/viewforum.php?f=30
Moderators Mow Green, AH-VSOPs
Security Tools Updates
http://forum.aumha.org/viewforum.php?f=31
Don't post a HijackThis log until you have already done preliminary scanning of your system for parasites. I recommend you go to my Parasite Fight page on this site - http://aumha.org/a/parasite.htm - and click the "Quick Fix" link to go to the bottom of the page. (Or, just go directly to http://aumha.org/a/quickfix.htm.) Run all steps indicated, exactly as specified. Make the HJT log your last step, then post it here if you are still having problems.
http://forum.aumha.org/viewtopic.php?t=4075
SpyWare BeWare
http://forums.maddoktor2.com/index.php?showforum=17
http://spyblocker-software.com/IPB/index.php
cexx.org discussion boards
http://boards.cexx.org/viewforum.php?f=1
Computer Cops
http://computercops.biz/forum67.html
Geeks to Go Computer Help Forum
http://www.geekstogo.com/forum/index.php?showforum=37
HijackThis log tutorial
http://homepage.ntlworld.com/dvk01uk/hjttut.htm
http://www.geekstogo.com/forum/index.php?showtopic=61
After your system is Clean of spyware
http://windowsupdate.microsoft.com/ - Windows Update (IMPORTANT!)
http://www.microsoft.com/windowsxp/downloads/updates/sp2/cdorder/en_us/default.mspx- XP SP2 on CD (FREE!)
http://www.javacoolsoftware.com/spywareblaster.html - SpywareBlaster