Author Topic: HiJackthis Log - need help (Read 8873 times)

wonderer · « **on:** August 10, 2006, 08:48:08 AM »

I have Windows 2000, NAV, Zone Alarm, Adaware, Spybot,
Keep getting a box in bottom corner of the screen tha says, "your computer is infected"; homepage was changed from Google to a funny looking Netscape page, email has gone somewhere, went to find out how email was set up and could not find the info to check on the outgoing server, etc. (I just might be paranoid and need to look again???) Anyway, here's my log if you could please help.) I have 7.0 Netscape and noticed another Netscape version was trying to download or something....is that possible without telling it to?

Logfile of HijackThis v1.98.0
Scan saved at 9:28:38 AM, on 8/10/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINNT\System32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\ptssvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Sierra\GPlan\CALTRAY.EXE
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\Documents and Settings\my name was inserted here\Desktop\Utilities\HijackThis.exe
C:\WINNT\system32\notepad.exe

N1 - Netscape 4: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Program Files\Netscape\Users\my name was inserted here\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {f7d40011-29bb-43eb-9c97-875ce89e9e36} - C:\WINNT\system32\hp100.tmp
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Sierra Garden Planner Tray Application.lnk = C:\Sierra\GPlan\CALTRAY.EXE
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126964476270
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O21 - SSODL: cholecyst - {ee2975b6-e8d5-405e-8448-8fe9590f6cfb} - C:\WINNT\system32\mzoeut.dll

squirrel · « **Reply #1 on:** August 10, 2006, 10:20:44 AM »

this looks like only part of it. it will take several posts to get it all. give us the rest and we can talk you through it.

it should go up to O23

squirrel · « **Reply #2 on:** August 10, 2006, 11:06:28 AM »

from what you've posted so far, here's what i found:

O2 - BHO: (no name) - {f7d40011-29bb-43eb-9c97-875ce89e9e36} - C:\WINNT\system32\hp100.tmp

This is a trojan. (heve hijack this fix it)

wonderer · « **Reply #3 on:** August 10, 2006, 11:10:05 AM »

I just ran it again (it comes up really fast, is that normal?)
Anyway, that's all the numbered sections that came up.

At the top it said HiJack This V1.98.0
Is this the version? Does this program have updates. If so, could you give instructions how to do?

I also get this message every time I go to a different website:
"This information you have entered is to be sent over an unencryped connection and could easily be read by a 3rd party.
And there is a checkbox that is checked that says: Alert me whenever I submit info that's not encrypted. Do you want to send?"

squirrel · « **Reply #4 on:** August 10, 2006, 11:11:28 AM »

yes, there is an update.

http://computercops.biz/zx/Merijn/hijackthis.zip

2k_dummy · « **Reply #5 on:** August 10, 2006, 11:21:47 AM »

Quote

I also get this message every time I go to a different website:
"This information you have entered is to be sent over an unencryped connection and could easily be read by a 3rd party.
And there is a checkbox that is checked that says: Alert me whenever I submit info that's not encrypted. Do you want to send?"

This message is controlled from the browser preferences. It can be turned off if you don't want to see it.

GX1_Man · « **Reply #6 on:** August 10, 2006, 05:14:57 PM »

What are you using for malware protection currently? What about any recent scans?

Post a new log after you make the correction listed.

wonderer · « **Reply #7 on:** August 10, 2006, 08:22:03 PM »

Using Ad-Aware 6.0 and there is also an icon for Ad-watch 3.0 on the desktop. I usually use Ad-Aware 6.0.

Got the HJT update loaded and here's the new log. (I deleted that Trojan...looks like it "took.")

Logfile of HijackThis v1.99.1
Scan saved at 9:14:25 PM, on 8/10/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINNT\System32\drivers\CDAC11BA.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\ptssvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Sierra\GPlan\CALTRAY.EXE
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\system32\NOTEPAD.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\my name was inserted her\LOCALS~1\Temp\Rar$EX01.201\HijackThis.exe

F3 - REG:win.ini: run=hpfsched
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Program Files\Netscape\Users\my name was inserted here\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Sierra Garden Planner Tray Application.lnk = C:\Sierra\GPlan\CALTRAY.EXE
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1126964476270
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O20 - Winlogon Notify: NavLogon - C:\WINNT\System32\NavLogon.dll
O21 - SSODL: cholecyst - {ee2975b6-e8d5-405e-8448-8fe9590f6cfb} - C:\WINNT\system32\mzoeut.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINNT\System32\drivers\CDAC11BA.EXE
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: ptssvc - KODAK - C:\Program Files\Kodak\Kodak EasyShare software\bin\ptssvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe

(cont'd next posting)

wonderer · « **Reply #8 on:** August 10, 2006, 08:23:11 PM »

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

wonderer · « **Reply #9 on:** August 10, 2006, 08:29:01 PM »

My home page is supposed to be Google (not Netscape)...I've changed it back in the preference area and it now loads to Google.

My email have vanished thru the Netscape browser. I do not have a Netscape email acct. It's from our IPS.

squirrel · « **Reply #10 on:** August 11, 2006, 01:14:42 PM »

O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINNT\System32\drivers\CDAC11BA.EXE

Did you install C-Dilla or anything with a similar name?

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx

did you install the &Radio toolbar?

wonderer · « **Reply #11 on:** August 12, 2006, 11:55:13 AM »

Regarding below queries, the answer is No
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINNT\System32\drivers\CDAC11BA.EXE
Did you install C-Dilla or anything with a similar name? NO!

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
did you install the &Radio toolbar NO!

Should I delete these?

-----------

Also, because I'm paranoid

, I'm using library computers for the time being, so as not to inflict further "damage" to my 'puter. Is that a good thing to do? (So, it takes me awhile to get back to y'all.)

1. Could I have Spyquake with that "Your Computer is Infected" box that keeps popping up?
2. At one time on NAV, it said something about zlob, but NAV couldn't delete. There were two other ones found too. I think they had something to do with spyquake and spyquake doctor or something.

GX1_Man · « **Reply #12 on:** August 12, 2006, 01:20:07 PM »

Do you have a real Windows CD to reinstall with if needed? That is the ultimate solution for this mess if these bandaids do not work.

dl65 · « **Reply #13 on:** August 12, 2006, 01:52:04 PM »

wonderer........ It would appear , that the entry........
O21 - SSODL: cholecyst - {ee2975b6-e8d5-405e-8448-8fe9590f6cfb} - C:\WINNT\system32\mzoeut.dll ..... the result of spywarequake ..... is whats causing the pop up ......... Have a read below on how to remove it [highlight].......(spywarequake is a rogue antispyware program )[/highlight]
http://www.pcdoctor-guide.com/wordpress/files/spywarequakeremove.pdf

dl65

GX1_Man · « **Reply #14 on:** August 12, 2006, 06:07:35 PM »

And here is some good reading as well:

http://www.computerhope.com/cgi-bin/yabb/YaBB.cgi?num=1154803768

Computer Hope Forum

News:

Author Topic: HiJackthis Log - need help (Read 8873 times)

wonderer

HiJackthis Log - need help

squirrel

Re: HiJackthis Log - need help

squirrel

Re: HiJackthis Log - need help

wonderer

Re: HiJackthis Log - need help

squirrel

Re: HiJackthis Log - need help

2k_dummy

Re: HiJackthis Log - need help

GX1_Man

Re: HiJackthis Log - need help

wonderer

Re: HiJackthis Log - need help

wonderer

Re: HiJackthis Log - need help

wonderer

Re: HiJackthis Log - need help

squirrel

Re: HiJackthis Log - need help

wonderer

Re: HiJackthis Log - need help

GX1_Man

Re: HiJackthis Log - need help

dl65

Re: HiJackthis Log - need help

GX1_Man

Re: HiJackthis Log - need help