|
#42
01-24-2005
|
|||
|
|||
|
dubR
You did a rotten job, you should have eliminated R0, R1, R3 and O3, O16 as well as O4 loadqm and some file missing O9's. You also should have installed, run and "inoculated" your PC through Spybot S&D. If you install Firefox (as advised), there is no need for all those cheapie/freebie popup-stoppers, Firefox does that FOR you. Next time, please READ the instructions and follow them EXACTLY, as I said before! Being German/Swiss/Austrian is NO excuse not to follow those simple instructions! Reboot in Safe Mode, then UNinstall (if you can) anything to do with: C:\PROGRA~1\PANICW~1\POP-UP~1\ C:\Programme\younreen\FlashGet C:\Programme\Popup Eliminator\ C:\Programme\WinPcap\ Now run HJT on its own, let it 'fix': R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...ch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com R3 - Default URLSearchHook is missing O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: Alles mit FlashGet laden - C:\Programme\younreen\FlashGet\jc_all.htm O8 - Extra context menu item: Mit FlashGet laden - C:\Programme\younreen\FlashGet\jc_link.htm O9 - Extra button: Popup Eliminator - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Programme\Popup Eliminator\PEToolBar490.dll (file missing) O9 - Extra 'Tools' menuitem: Popup Eliminator - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\Programme\Popup Eliminator\PEToolBar490.dll (file missing) O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\younreen\FlashGet\flashget.exe (file missing) O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\younreen\FlashGet\flashget.exe (file missing) O16 - DPF: Interface Chat Wanadoo - http://chat7.x-echo.com/Applet/wchatsign.cab O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com.../c381/chat.cab O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab O16 - DPF: {072D3F2E-5FB6-11D3-B461-00C04FA35A21} (CFForm Runtime) - http://www.soundclick.com/CFIDE/classes/CFJava.cab O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Basic) - http://applications.nmpp.fr/spot/inc/ScriptX.cab O16 - DPF: {27DA08CF-FCDB-C812-102C-35416A233100} - http://abcfunny.xxxhard.com/xxxhard.exe O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com...45/yacscom.cab O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.co...veX/winrep.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/21482601a2aa801...dxIE601_fr.cab O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall-Kontrolle) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab O16 - DPF: {78A730D4-0DF3-4B65-8DD2-BFCD433CEE30} - http://www.surfsecret.com/inst/PEInstaller.exe O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} - http://fdl.msn.com/public/chat/msnchat42.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab O16 - DPF: {8E6AA867-94D4-4B4F-8791-1B048F8C122A} (WebInterface Class) - https://fastsend.com/products/Fsplugin.cab O16 - DPF: {9EB320CE-BE1D-4304-A081-4B4665414BEF} - http://www.35mb.com/applet.cab O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yaho...tocomplete.cab O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yaho...opper1_1us.cab O16 - DPF: {C4A8A4DA-BD3F-4DEB-9BBB-5B6BD3571EC7} (CDKeyCtl Class) - http://www.cdkey-promotions.com/download/CDKey.cab O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.yaho...io4_0_2_10.cab O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab O23 - Service: Remote Packet Capture Protocol v.0 (experimental) - Unknown - %ProgramFiles%\WinPcap\rpcapd.exe (file missing) Delete the bold files. When a directory is also bold, delete everything in it, including that directory itself. And I hope sincerely that you followed the other items in my post! |
|
|
#43
02-06-2005
|
||||
|
||||
|
I need a little guidance..
Hello..I have been reading the forums and reading these posts for a couple of days now to see if I could use someones log/solution to figures this out but alas no luck. Went to the locked thread and performed the needed fixs, and scans in safe. It cleaned out almost everything. I just have a couple of things that I am not to sure to do with. I have quit using Interet explorer and I am now using firefox 1.0 (and lovin' it!!) and the "015" entries I have already taken care of could you guys give me a hand with the rest.
(i know i should get rid of the "09"'s as well  )Thank you in advance |
|
#44
02-07-2005
|
|||
|
|||
|
fyrebabe
Yours is easily the shortest log I have seen in a long time. Glad you did your homework. Take this one out of your boot-sequence, it is only checking for updates, which you can do manually just as well. O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe You may need to set some switch in the Java-console to NOT check for updates. A few small things. Boot in Safe Mode Run HJT on its own and let it 'fix' (if still there): R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O15 - Trusted Zone: *.frame.crazywinnings.com O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM) O15 - Trusted IP range: (HKLM) |
|
#46
02-13-2005
|
|||
|
|||
|
Hey, I was just thinking if you could see something wrong in this..?
Logfile of HijackThis v1.99.0 Scan saved at 5:58:34 PM, on 2/13/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Linksys\ADSL USB Modem\CnxDslTb.exe C:\PROGRAMS\Winamp\winampa.exe C:\WINDOWS\system32\qttask.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\PROGRAMS\Messenger Plus! 3\MsgPlus.exe C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\PROGRAMS\iTunes\iTunesHelper.exe C:\Programs\Error Nuker\bin\ErrorNuker.exe C:\PROGRAMS\Norton AntiVirus\navapsvc.exe C:\PROGRAMS\Norton AntiVirus\AdvTools\NPROTECT.EXE C:\PROGRAMS\Panorama\Panorama.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\Program Files\iPod\bin\iPodService.exe C:\Documents and Settings\Alisha\Desktop\ClutterBuster.exe C:\MOI\winmxbeta3\WinMX.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\MOI\WinMX\MXM\MXMoni128Eb\MXMoniE.exe C:\PROGRAMS\RoboMX\RoboMX.exe C:\WINDOWS\system32\mspaint.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\PROGRAMS\DesktopMaster 2.0\dm.exe C:\PROGRAMS\DesktopMaster 2.0\dm2launcher.exe C:\PROGRAMS\iTunes\iTunes.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Messenger\msmsgs.exe C:\DOCUME~1\Alisha\LOCALS~1\Temp\Rar$EX00.064\HijackThis.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Macromedia Licensing Service - Unknown - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\PROGRAMS\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\PROGRAMS\Norton AntiVirus\AdvTools\NPROTECT.EXE O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Sony SPTI Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe (file missing) |
|
#47
02-14-2005
|
|||
|
|||
|
You have a number of doubtfuls and definitely spyware on your PC.
Go to this post here first, and follow the instructions EXACTLY. How to remove Begin2Search/Coolwebsearch and Other Nasties Then see How to post your Hijackthis log-files. This is definitely wrong: C:\PROGRAMS\Winamp\winampa.exe C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe Look into this lot and see what you can get rid of, while you are at it: C:\PROGRAMS\Messenger Plus! 3\MsgPlus.exe [Hope you installed MessengerPlus WITHOUT that "sponsor program"!] C:\Programs\Error Nuker\bin\ErrorNuker.exe C:\PROGRAMS\Panorama\Panorama.exe C:\Documents and Settings\Alisha\Desktop\ClutterBuster.exe C:\MOI\winmxbeta3\WinMX.exe C:\MOI\WinMX\MXM\MXMoni128Eb\MXMoniE.exe C:\PROGRAMS\RoboMX\RoboMX.exe C:\PROGRAMS\DesktopMaster 2.0\dm.exe C:\PROGRAMS\DesktopMaster 2.0\dm2launcher.exe |
|
#48
02-15-2005
|
|||
|
|||
|
PLease Help - PC making me physically ill
Here is my hijack this log...........
file of HijackThis v1.99.0 Scan saved at 20:57:59, on 15/02/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wuacti.exe C:\WINDOWS\System32\lsass2k.exe C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe C:\WINDOWS\system32\ps2.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\System32\hkcmd.exe C:\WINDOWS\System32\DeltTray.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\Windows AdStatus\WinStat.exe C:\WINDOWS\System32\igfxtray.exe C:\WINDOWS\msnmsgq.exe C:\WINDOWS\svchst.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\System32\MDNZ.exe C:\Program Files\Windows AdStatus\WinStatKeep.exe C:\Program Files\Microsoft Office\Office\FINDFAST.EXE C:\Program Files\Microsoft Office\Office\OSA.EXE C:\WINDOWS\System32\wuauclt.exe C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-aware.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Windows\ur14.exe C:\WINDOWS\System32\mcrt32.exe C:\WINDOWS\System32\smtp32.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Owner\Desktop\hijackthis.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Tiscali R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: BHO Class - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file) O4 - HKLM\..\Run: [lsass2k Update] lsass2k.exe O4 - HKLM\..\Run: [NAV Auto Updates] navupdaters.exe O4 - HKLM\..\Run: [Windows Auto Update] wuacti.exe O4 - HKLM\..\Run: [NvCplScan] winasp.exe O4 - HKLM\..\Run: O4 - HKLM\..\Run: [Windows Media Player] msa.exe O4 - HKLM\..\Run: [VTTimer] VTTimer.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Start Uppings] mssupdate.exe O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Microsoft CSRSS386 Protocol] csrss386.exe O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [DeltTray] DeltTray.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [Windows AdStatus] C:\Program Files\Windows AdStatus\WinStat.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [msnmsgq32] C:\WINDOWS\msnmsgq.exe O4 - HKLM\..\Run: [SvcH0st] C:\WINDOWS\svchst.exe /i O4 - HKLM\..\Run: [MDN] MDNZ.exe O4 - HKLM\..\Run: [antiware] C:\windows\system32\eliterjo32.exe O4 - HKLM\..\Run: [Start Upping] mcrt32.exe O4 - HKLM\..\Run: [SMTP32 Mailing Protocol] smtp32.exe O4 - HKLM\..\RunServices: [Windows Media Player] msa.exe O4 - HKLM\..\RunServices: [Windows Auto Update] wuacti.exe O4 - HKLM\..\RunServices: [Microsoft CSRSS386 Protocol] csrss386.exe O4 - HKLM\..\RunServices: [Start Uppings] mssupdate.exe O4 - HKLM\..\RunServices: [lsass2k Update] lsass2k.exe O4 - HKLM\..\RunServices: [NvCplScan] winasp.exe O4 - HKLM\..\RunServices: [msupdate] update.exe O4 - HKLM\..\RunServices: [NAV Auto Updates] navupdaters.exe O4 - HKLM\..\RunServices: [MDN] MDNZ.exe O4 - HKLM\..\RunServices: [Start Upping] mcrt32.exe O4 - HKLM\..\RunServices: [SMTP32 Mailing Protocol] smtp32.exe O4 - HKLM\..\RunOnce: [Windows Auto Update] wuacti.exe O4 - HKCU\..\Run: [lsass2k Update] lsass2k.exe O4 - HKCU\..\Run: [NAV Auto Updates] navupdaters.exe O4 - HKCU\..\Run: [Windows Auto Update] wuacti.exe O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [MDN] MDNZ.exe O4 - HKCU\..\Run: [Start Upping] mcrt32.exe O4 - HKCU\..\Run: [SMTP32 Mailing Protocol] smtp32.exe O4 - HKCU\..\RunServices: [Start Uppings] mssupdate.exe O4 - HKCU\..\RunOnce: [Windows Auto Update] wuacti.exe O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: v3cab - O16 - DPF: O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab O16 - DPF: {771A1334-6B08-4A6B-AEDC-CF994BA2CEBE} (Installer Class) - O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} (IObjSafety.DemoCtl) - [ O17 - HKLM\System\CCS\Services\Tcpip\..\{F55AC4C9-8A2B-4EB2-884F-432BF6A4D66A}: NameServer = 80.225.253.50 80.225.253.58 O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe I KNOW - IT'S MASSIVE - I'M SURE THERE ARER LOTS OF THINGS TO DELETE - HAVE DELETED SOME ALREADY BEFORE POSTING THIS! I CAN'T GO ON AT THE MOMENT - MY PC STINKS!!! I HAVE HAD TO DELETE SOME URL'S |
|
#49
02-16-2005
|
|||
|
|||
|
ywain
Go to this post here first, and follow the instructions EXACTLY. How to remove Begin2Search/Coolwebsearch and Other Nasties Then see How to post your Hijackthis log-files. I need the full log to work with. |
|
|
#50
02-24-2005
|
|||
|
|||
|
My Log File Please Check 4 Me
Please can u check my log file please as ive been on tom coyote and they dont seem to want to answer.
I seem to be getting slow connections and spyware all the time ive been that p---ed off ive formatted 3 times in 2 days. Tried to attach mt log file but it's not letting me Logfile of HijackThis v1.99.1 Scan saved at 16:10:25, on 24/02/2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\htpatch.exe C:\WINDOWS\Gtwatch.exe C:\WINDOWS\System32\Svhost.exe C:\WINDOWS\System32\svapache.exe C:\WINDOWS\System32\RUNDLL32.EXE C:\WINDOWS\System32\CTHELPER.EXE C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe C:\Program Files\Zoom Telephonics, Inc\Zoom ADSL USB Modem\dslmon.exe C:\WINDOWS\twain_32\A12U16KD\WATCH.exe C:\WINDOWS\System32\mcafee32.exe C:\Documents and Settings\Johnny Wright\ballin.exe C:\WINDOWS\System32\morrn10n.exe C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe C:\Program Files\Internet Explorer\iexplore.exe C:\hijackthis\HijackThis.exe F2 - REG:system.ini: Shell=Explorer.exe mcafee32.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll (file missing) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe O4 - HKLM\..\Run: [Gtwatch] C:\WINDOWS\Gtwatch.exe O4 - HKLM\..\Run: [Microsoft Update] Svhost.exe O4 - HKLM\..\Run: [Microsoft Explorer] svapache.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe" O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run O4 - HKLM\..\Run: [Windows Service Pack Auto Update] C:\Documents and Settings\Johnny Wright\ballin.exe O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe" O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe" O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe O4 - HKLM\..\RunServices: [Microsoft Update] Svhost.exe O4 - HKLM\..\RunServices: [Microsoft Explorer] svapache.exe O4 - HKLM\..\RunOnce: [Register C:\WINDOWS\System32\msbe.dll] "C:\WINDOWS\System32\rundll32.exe" "C:\WINDOWS\System32\msbe.dll",DllRegisterServer O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Microsofot x386 System Monitor] system32.exe O4 - HKCU\..\Run: [Microsoft Update] Svhost.exe O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe" O4 - HKCU\..\Run: [Z056RTi9j] morrn10n.exe O4 - Global Startup: DSLMON.lnk = ? O4 - Global Startup: Watch.lnk = C:\WINDOWS\twain_32\A12U16KD\WATCH.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CD...ridge-c139.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{9950F780-94D0-4F58-973B-CD5FEB275F76}: NameServer = 213.40.66.126 213.40.130.126 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Microsofot x386 System Monitor (SysManager) - Unknown owner - C:\WINDOWS\System32\system32.exe" -netsvcs (file missing) |
|
#51
02-24-2005
|
|||
|
|||
|
mrnevermind
Go to this post here first, and follow the instructions EXACTLY. How to remove Begin2Search/Coolwebsearch and Other Nasties Then see How to post your Hijackthis log-files. I need the FULL log-file to work with. |
|
#52
02-25-2005
|
|||
|
|||
|
Hijack this - help (beginner)
Can anybody help please - I thought I was being secure - but I am having pronblems with adobe acrobat 6.0. It just keeps closing on me !! I have tried everything even reinstalling, but too no avail.
Can anybody check my log below. Thanks guys Jennifer x Logfile of HijackThis v1.99.1 Scan saved at 13:44:38, on 25/02/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Norton Internet Security\ISSVC.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\crypserv.exe C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\ICO.EXE C:\WINDOWS\System32\ezSP_Px.exe C:\Program Files\Sony\HotKey Utility\HKserv.exe C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\Program Files\Sony\HotKey Utility\HKWnd.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\INTEL\DSLSetup\ProDsl.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\Corel\Suite8\Programs\DAD8.EXE C:\Program Files\FinePixViewer\QuickDCF.exe C:\Program Files\Hewlett-Packard\hp deskjet 450 printer\ToolBox\mpm.exe C:\Program Files\PowerPanel\Program\PcfMgr.exe C:\Program Files\MailWasher\MailWasher.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Rizwan Majid\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.tiscali.co.uk/search/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.bbc.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tiscali.co.uk R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Tiscali O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe O4 - HKLM\..\Run: [HKSERV.EXE] C:\Program Files\Sony\HotKey Utility\HKserv.exe O4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [DSL Connection Manager] C:\Program Files\INTEL\DSLSetup\ProDsl.exe /P O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: Corel Desktop Application Director 8.LNK = C:\Corel\Suite8\Programs\DAD8.EXE O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE O4 - Global Startup: Exif Launcher.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: myPrintMileage.lnk = C:\Program Files\Hewlett-Packard\hp deskjet 450 printer\ToolBox\mpm.exe O4 - Global Startup: PowerPanel.lnk = ? O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O14 - IERESET.INF: START_PAGE_URL=http://www.tiscali.co.uk O15 - Trusted Zone: *.sony-europe.com O15 - Trusted Zone: *.sonystyle-europe.com O15 - Trusted Zone: *.vaio-link.com O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.co...s/MsnPUpld.cab O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\System32\HPZipm12.exe (file missing) O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe |
|
#53
02-25-2005
|
|||
|
|||
|
Nothing wrong with your log.
Looks like you downloaded a trial-version of Acrobat and it was stopped after 30 days or so, thanks to crypserv.exe Either uninstall Acrobat or buy it. I don't think that deleting crypserv.exe will make it work again, but you can always try... |
|
#54
02-25-2005
|
|||
|
|||
|
Assist?
Okay, I have Spybot, Ad-aware, AVG (7.0), Spywareblaster, and Firefox.
I also have an idiot assholic little bro who downloads free Korean MMORPGs and other questionable file content. And popups for nude poker that crash me during my WoW gaming. please assist? All my anti-spyware software is up to date. Logfile of HijackThis v1.99.1 Scan saved at 11:37:11 AM, on 2/25/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Microsoft IntelliPoint\point32.exe C:\Program Files\Microsoft Hardware\Keyboard\type32.exe C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\WINDOWS\emsw.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Analog Devices\SoundMAX\Smtray.exe C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe C:\Program Files\AIM\aim.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe C:\PROGRA~1\ICQ\ICQ.exe C:\Program Files\Software Internationals\MuckClient\muckclient.exe C:\Program Files\Yahoo!\Messenger\ypager.exe C:\WINDOWS\system32\smbdins.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\DOCUME~1\ZACHGR~1\LOCALS~1\Temp\Temporary Directory 6 for hijackthis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://clearsurfing.net/srch.php?qq=%s R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1 O2 - BHO: Name - {42C14EA0-DAC2-4D62-AD1E-15D670E69AE9} - C:\WINDOWS\System32\msnfx.dll O2 - BHO: Name - {492148AF-3606-4008-8845-5B93FF248EFC} - C:\WINDOWS\System32\msnfx.dll O4 - HKLM\..\Run: [] C:\WINDOWS\Options\OEMReset.exe /Audit O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe" O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe" O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\VERIZO~1\SMARTB~1\MotiveSB.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Mirabilis ICQ] C:\PROGRA~1\ICQ\ICQNet.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [StatusCheck] keybdll.exe O4 - HKLM\..\Run: [syspanel] killall.exe O4 - HKLM\..\Run: [emsw.exe] C:\WINDOWS\emsw.exe O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet O4 - HKCU\..\Run: [zxc] WTFCTF.exe O4 - HKCU\..\Run: [uio] pizda.exe O4 - HKCU\..\Run: [xwiz] StartCpl.exe O4 - HKCU\..\Run: [emsw.exe] C:\WINDOWS\emsw.exe O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O4 - Global Startup: Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\bin\matcli.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe |
|
#55
02-25-2005
|
|||
|
|||
|
hijack this / hijackthis
please help, i have got viruses on computer
here is hijackthis log: Logfile of HijackThis v1.99.1 Scan saved at 19:35:17, on 20/02/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Norman\NVC\BIN\Zanda.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wdfmgr.exe C:\NORMAN\Nvc\BIN\NJEEVES.EXE C:\NORMAN\Nvc\BIN\nvcoas.exe C:\NORMAN\Nvc\BIN\nipsvc.exe C:\NORMAN\Nvc\BIN\NVCSCHED.EXE C:\WINDOWS\System32\alg.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\SOUNDMAN.EXE C:\ATI-CPanel\atiptaxx.exe C:\NORMAN\Nvc\BIN\ZLH.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\NORMAN\Nvc\BIN\NYMSE.EXE C:\NORMAN\Nvc\BIN\NIP.EXE C:\NORMAN\Nvc\BIN\cclaw.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\isrvs\desktop.exe C:\windows\system32\deqmbpo.exe C:\WINDOWS\system32\mdwhping.exe C:\WINDOWS\system32\cmd.exe C:\Program Files\AutoUpdate\AutoUpdate.exe C:\WINDOWS\system32\cmd.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\WINDOWS\system32\cmd.exe C:\Program Files\Messenger\msmsgs.exe C:\windows\system32\calc.exe C:\Program Files\Spyware Doctor\swdoctor.exe C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg4.EXE C:\Program Files\CxtPls\CxtPls.exe C:\NORMAN\Nvc\BIN\NVCOD.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Luke Roche\Local Settings\Temporary Internet Files\Content.IE5\MI4XLSP1\hijackthis[1]\HijackThis.exe C:\Program Files\iTunes\iTunes.exe C:\WINDOWS\explorer.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://69.42.87.219/sidesearch.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://69.42.87.219/sidesearch.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://69.42.87.219/sidesearch.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir...r=6&ar=msnhome R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir...ie&ar=iesearch R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://69.42.87.219/sidesearch.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://69.42.87.219/sidesearch.html R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.microsoft.com/isapi/redir...r=6&ar=msnhome F2 - REG:system.ini: Shell=Explorer.exe winsock.scr O2 - BHO: DLMaxObj Class - {00000000-59D4-4008-9058-080011001200} - C:\WINDOWS\dlmax.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: RsyncHlpr Class - {16B238D5-80DE-47CE-8F17-B3ECE2C2248D} - C:\WINDOWS\system32\rsyncmon.dll O2 - BHO: IE Update Class - {5B4AB8E2-6DC5-477A-B637-BF3C1A2E5993} - C:\WINDOWS\isrvs\sysupd.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll O2 - BHO: ohb - {988CAFC4-DC0D-4D8C-A35E-5028ABE9E641} - C:\WINDOWS\system32\ic2_win.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\Nvc\BIN\ZLH.EXE /LOAD /SPLASH O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe O4 - HKLM\..\Run: [C:\WINDOWS\system32\opeAB0.exe ] C:\WINDOWS\system32\opeAB0.exe O4 - HKLM\..\Run: [WinDSNX] C:\WINDOWS\system32\ope29.exe O4 - HKLM\..\Run: [dxset.exe] C:\WINDOWS\dxsetu.exe O4 - HKLM\..\Run: [C:\WINDOWS\system32\opeABF.exe ] C:\WINDOWS\system32\opeABF.exe O4 - HKLM\..\Run: [C:\WINDOWS\system32\ope28.exe ] C:\WINDOWS\system32\ope28.exe O4 - HKLM\..\Run: [RSync] C:\WINDOWS\system32\netsync.exe O4 - HKLM\..\Run: [AutoLoaderAproposClient] "C:\DOCUME~1\TOMROC~1\LOCALS~1\Temp\cxtpls_loader.exe" /HideUninstall /HideDir /PC=CP.DEF2 /ForSupportedBrowsers /ShowLegalNote=nonbranded O4 - HKLM\..\Run: [Desktop Search] C:\WINDOWS\isrvs\desktop.exe O4 - HKLM\..\Run: [ffis] C:\WINDOWS\isrvs\ffisearch.exe O4 - HKLM\..\Run: [deqmbpo] c:\windows\system32\deqmbpo.exe O4 - HKLM\..\Run: [farmmext] C:\WINDOWS\farmmext.exe O4 - HKLM\..\Run: [47oV3mQ] mdwhping.exe O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe" O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q O4 - Global Startup: MA111 Configuration Utility.lnk = C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache...p1.0.0.8-2.cab O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ms...downloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary...o.cab32846.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{25A72BFF-93FB-45B9-B21F-6456808F85E1}: NameServer = 62.60.123.225,194.176.201.193 O18 - Filter: text/html - {950238FB-C706-4791-8674-4D429F85897E} - C:\WINDOWS\isrvs\mfiltis.dll O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe O23 - Service: Norman NJeeves - Unknown owner - C:\NORMAN\Nvc\BIN\NJEEVES.EXE O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\NVC\BIN\Zanda.exe O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe thanks luke |
|
#56
02-25-2005
|
|||
|
|||
|
acrobat - realblackstuff
hi
thanks for checking the log - the adobe acrobat 6.0 is what i use - it is a legitimate version, I have the original disc etc.. it automatically keeps shutting down when i try and create a pdf file from a web page or document. should I delete the crypserve? what is the crypserve?? thanks j. |
|
#57
02-25-2005
|
|||
|
|||
|
JenniferUK
The program crypserv.exe is used to stop trial-programs from working after, say, 30 days. Is that Acrobat a recent installation? It MAY have used crypserv, but not necessarily. Have you tried Firefox for webbrowser (you should get it anyway, www.getfirefox.com) ? It could be that something in the IE-settings prevents Acrobat. Try and save the web-page first to your PC, then 'pdf' it from there. I have no experience with Acrobat (only the Reader), perhaps someone else knows more? Check if there is a FAQ on the Adobe website. |
|
#58
02-25-2005
|
|||
|
|||
|
Rametarin
Move HJT to its OWN directory, not in Temp or on the Desktop Boot in Safe Mode Switch System restore OFF Press ctrl/alt/del and in Taskmanager try to STOP: emsw.exe ViewMgr.exe muckclient.exe smbdins.exe OEMReset.exe keybdll.exe killall.exe WTFCTF.exe pizda.exe StartCpl.exe Next, try to UNinstall anything to do with: C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Software Internationals\MuckClient\muckclient.exe Next, run HJT on its own and let it 'fix' (if still there): C:\WINDOWS\emsw.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Software Internationals\MuckClient\muckclient.exe C:\WINDOWS\system32\smbdins.exe R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://clearsurfing.net/srch.php?qq=%s R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = 127.0.0.1 O2 - BHO: Name - {42C14EA0-DAC2-4D62-AD1E-15D670E69AE9} - C:\WINDOWS\System32\msnfx.dll O2 - BHO: Name - {492148AF-3606-4008-8845-5B93FF248EFC} - C:\WINDOWS\System32\msnfx.dll O4 - HKLM\..\Run: [] C:\WINDOWS\Options\OEMReset.exe /Audit ==>> ONLY 'fix' <<== O4 - HKLM\..\Run: [StatusCheck] keybdll.exe O4 - HKLM\..\Run: [syspanel] killall.exe O4 - HKLM\..\Run: [emsw.exe] C:\WINDOWS\emsw.exe O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKCU\..\Run: [zxc] WTFCTF.exe O4 - HKCU\..\Run: [uio] pizda.exe O4 - HKCU\..\Run: [xwiz] StartCpl.exe O4 - HKCU\..\Run: [emsw.exe] C:\WINDOWS\emsw.exe O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ? O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present When done, delete the bold files. When a directory is also bold, delete everything in it, including that directory itself. Boot normal. If all OK, turn System Restore back on. Next, put a big roll of barbed wire around your PC, and put a password in the BIOS, to prevent unauthorised access. Store that password also in a safe place and remember WHERE you put it! |
|
#59
02-25-2005
|
|||
|
|||
|
lroche
Go to this post here first, and follow the instructions EXACTLY. How to remove Begin2Search/Coolwebsearch and Other Nasties Then see How to post your Hijackthis log-files. |
|
#60
02-27-2005
|
|||
|
|||
|
problems with freshbar
Could someone help me to get rid of the annoying toolbar and other waste. There´s my hijackthis log:
Logfile of HijackThis v1.99.1 Scan saved at 13:52:52, on 27.2.2005 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.EXE C:\OHJELMATIEDOSTOT\F-SECURE\COMMON\FSMA32.EXE C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE C:\OHJELMATIEDOSTOT\F-SECURE\COMMON\FSMB32.EXE C:\WINDOWS\SYSTEM\DEVLDR16.EXE C:\OHJELMATIEDOSTOT\F-SECURE\COMMON\FCH32.EXE C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE C:\OHJELMATIEDOSTOT\F-SECURE\COMMON\FAMEH32.EXE C:\OHJELMATIEDOSTOT\F-SECURE\COMMON\FSGK32.EXE C:\OHJELMATIEDOSTOT\F-SECURE\VPNPLUS\PROGRAM\FSVPND.EXE C:\OHJELMATIEDOSTOT\F-SECURE\ANTI-VIRUS\FSAV32.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\RUNDLL32.EXE C:\OHJELMATIEDOSTOT\F-SECURE\COMMON\FSM32.EXE C:\WINDOWS\LOADQM.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\OHJELMATIEDOSTOT\ZONE LABS\ZONEALARM\ZLCLIENT.EXE C:\OHJELMATIEDOSTOT\ELISA TIETOTURVAPALVELU\4119343\PROGRAM\BACKWEB-4119343.EXE C:\OHJELMATIEDOSTOT\ELISA TIETOTURVAPALVELU\4119343\6.1.0.145-4119343L\PROGRAM\SPLASH.EXE C:\HJT\HIJACKTHIS.EXE R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = http://clearsurfing.net/srch.php?qq=%s R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Elisa Internet R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;<local> R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Name - {B09C89EE-3A3F-42DD-9013-6DCF4C4FA258} - C:\WINDOWS\SYSTEM\MSLFA.DLL O2 - BHO: (no name) - {1C2E2155-E0D0-430A-81C2-717D4D348D8A} - C:\WINDOWS\SYSTEM\SFCMAN32.DLL (file missing) O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\ohjelmatiedostot\google\googletoolbar1.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\OHJELM~1\SPYBOT~1\SDHELPER.DLL O3 - Toolbar: FreshBar - {06ABAA2D-34AB-4902-A326-409BD9B9A7A5} - C:\WINDOWS\SYSTEM\IECUSTOM32.DLL O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\ohjelmatiedostot\google\googletoolbar1.dll O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [F-Secure Manager] "C:\Ohjelmatiedostot\F-Secure\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [Zone Labs Client] "C:\Ohjelmatiedostot\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe O4 - HKLM\..\RunServices: [F-Secure Management Agent] C:\Ohjelmatiedostot\F-Secure\Common\FSMA32.EXE O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service O4 - HKCU\..\Run: [SpyKiller] C:\Ohjelmatiedostot\SpyKiller\spykiller.exe /startup O4 - HKCU\..\Run: [BestPopUpKiller] C:\Ohjelmatiedostot\BestPopUpKiller\BestPopupKiller.exe /startup O4 - Global Startup: Elisa Tietoturvapalvelu.lnk = C:\Ohjelmatiedostot\Elisa Tietoturvapalvelu\4119343\Program\backweb-4119343.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: &Google Search - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html O8 - Extra context menu item: Si&milar Pages - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html O8 - Extra context menu item: Backward &Links - res://C:\OHJELMATIEDOSTOT\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/ O16 - DPF: {11212111-2121-1311-1141-115611111222} - ms-its:mhtml:file://d: oo.mht!http://69.50.166.213/users/alex/web/...m::/update.exe O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/ms...downloader.cab O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 69.50.188.180,195.225.176.31 I´m a beginner and i´d be very thankful if someone could help me in this problem. |
 |
| Thread Tools | |
|
|
| Similar Topics | ||||
| Topic | Category | Replies | Last Post | |
| Advice needed on HiJackThis log | Virus & Malware removal | 11 | 12-29-2007 09:54 PM | |
| My HijackThis log | Virus & Malware removal | 6 | 11-08-2005 02:43 AM | |
| Hijackthis log file | Virus & Malware removal | 3 | 11-27-2004 07:17 AM | |
| How do I attach a file to a post, BROWSE missing ! | Site Feedback & Suggestions | 4 | 09-22-2004 11:06 PM | |
| Can anyone help with my HijackThis log? | Virus & Malware removal | 5 | 07-21-2004 10:32 AM | |
All times are GMT -4. The time now is 12:02 PM.