What are these on my HJT log?

[Kazi]

I have told you j played around with this program called autorun that someoneposted showing everything that started up when windows boots. I have disabled any suspicous stuff and deleted them and then the 024 thingy appeared

 

[Bobbye]

No, you did not tell me you 'played around with Autoruns'. You told me about some desktop "thingy" which is showing as an 024 entry. But there is no danger from that file anymore as the entry in the log shows that it is missing.

The following is the only removal that has worked:
Start> Control Panel> Display> Desktop> Customize Desktop> Web tab> uncheck and delete everything you find in there (except for "My current home page")> Also remove the check mark from the the Lock Desktop Items box if it is checked> Apply> OK> Close.

Now run HijackThis and if the entry is still there check it and fix it. Reboot and it should be gone. Please let me know.

 

[Kazi]

Gone after i deleted the file from web tab.

So is the hijack protocol items safe or not?

 

[Bobbye]

Please run Malwarebytes. See instructions in Post #16.
Also run SuperAntispyware:

SuperAntiSpyware Home Edition Free Version
* Please download SuperAntiSpyware from http://www.superantispyware.com/
* Launch SuperAntiSpyware and click on 'Check for updates'.
* Wait for the updates to be installed
* On the main screen click on 'Scan your computer'.
* Check: 'Perform Complete Scan then Click 'Next' to start the scan.
* Superantispyware will now scan your computer,when it's finished it will list all/any infections found.
* Make sure everything found has a checkmark next to it,then press 'Next'.
* Click on 'Finish' when you've done.

It's possible that the program will ask you to reboot in order to delete some files.

Obtain the SuperAntiSpyware log as follows:
Click on 'Preferences'.
Click on the 'Statistics/Logs' tab.
Under 'Scanner Logs' double click on 'SuperAntiSpyware Scan Log'.
It will then open in your default text editor,such as Notepad.
Attach the notepad file here on your reply

After completing both of these programs, run HijackThis. Post all three logs.

 

[Kazi]

Logs

Sry took some time

 

[Bobbye]

You started this thread 9 days ago, with no log until now, so I have nothing to compare. MBAM and SAS show you clean. The HijackThis log is basically clean except for:

O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL

ZoneAlarm Spy Blocker Toolbar, now installed as an optional with Zonealarm. Uses the Ask.com searchengine. Ask.com is not a good BHO to have on your computer

Review ask.com here:

http://www.benedelman.org/spyware/ask-toolbars/

Advise stop the process, uninstall in Add/Remove Programs.

You have many unnecessary startups. I notice multiple Warcraft Tools. What, if any problems are you having now> If none, we'll remove the cleaning tools and old restore points:
-----------------------------------------------------------------------
*OTCleanit! by Oldtimer*
* Download OTCleanIt (http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe)
* Click the CleanUp! button.
* It will go thorough the list and remove all of the tools it finds and then delete itself (requiring a reboot).

Clear System Restore points:
* This is a good time to clear your existing system restore points and establish a new clean restore point:
o Go to Start > All Programs > Accessories > System Tools > System Restore
o Select Create a restore point, and OK it.
o Next, go to Start > Run and type in cleanmgr
o Select the More options tab
o Choose the option to clean up system restore and OK it.
This will remove all restore points except the new one you just created.

 

[Kazi]

I did olt but when i did cleanmgr thingy but there was no more options or system restore, only my drives. i'm sorry for saying this but my question was wether the protocol hijack stuff was bad or not. I seem to not have any problems because i couldn't watch youtube vids in ie because the flash player wasn't installed

 

[Bobbye]

I understand what you started this thread with. However, without going through all the logs, the question was out of context and couldn't be answered.

Try deleting the restore points this way:
Set a new one first: All Programs> Accessories> System Tools> System Restore> check 'create a new restore point'> Next> let it complete.
Now go to the Control Panel> System> System Restore tab> CHECK 'turn off System Restore"> Apply> OK> Reboot.
The old restore points will be gone. Go back in and UNCHECK 'turn off System Restore'> Apply> OK.

As far as I can see, your logs showed you clean.

 

[Kazi]

Done anything else i have to do? i think the question's answer is uncertain

 

[Bobbye]

If you would like to check each of the 018 entries, copy the CLSID, paste it in the box on this site and click on the first letter of the process shown: http://www.castlecops.com/o18et-i.html

Here are some of them:
Protocol {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} L tv msvidctl.dll Item taken from whitelist of HijackThis
Protocol {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} L wia wiascr.dll Item taken from whitelist of HijackThis
Protocol {9D148291-B9C8-11D0-A4CC-0000F80149F6} L its, ms-its itss.dll Items taken from whitelist of HijackThis
Protocol {5C135180-9973-46D9-ABF4-148267CBB8BF} L lid msvidctl.dll Item taken from whitelist of HijackThis

If you are uncomfortable with what we did, you are free to post your question again and let someone else help you.

Your question was: "what are these". The definition of the 018 entries in HijackThis is: "extra protocols and protocol hijackers". The dewscription goes on to sat: "only a few hijackers show up here. The known baddies are "cn" (CommonName), 'ayb (Lop.com and 'related links' (Huntbar)I am asked to verify my installation. Other things that show up are either not confirned safe yet or are hijacked.(the CLSID has been changed by spyware)

I didn't find any indication of hijackers.

 

[Kazi]

After searching up on castlecops the protocol hijack like protocol hijack: http doesn't even shop up on castlecops.

 

[Bobbye]

If you would be more comfortable, have HijackThis remove all of the 018 entries.

 

[Kazi]

Hijackthis can remove everything but the entries that start with protocol hijack. After i restart hijackthis
they are gone

 

[Bobbye]

None f this makes any sense. You say HijackThis can't remove the 018 entries, but "After i restart hijackthis
they are gone". This seems to be a contradiction. I suspect the problem is whatever you did with AutoRuns.

 

[Kazi]

No hijackthis CAN remove them however only the protocol hijack items keep coming BACK. If i close and reopen hijackthis the 018 entries are GONE. This has happen a month before i even started this thread which is when i didn't know about techspot

 

[momok]

Could you post a fresh HijackThis log to check?

 

[Bobbye]

I have told you j played around with this program called autorun that someoneposted showing everything that started up when windows boots. I have disabled any suspicous stuff and deleted them and then the 024 thingy appeared

Could the -18 entries be due to anything you enabled at startup using AutoRuns?

 

[Kazi]

I had these before i knew about autorun too. Also i used a partition and it still came back.

uploading fresh hjt log for momok

The unknown vsoclib is okay, i checked the author of the file
...