Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

« previous next »
Pages: [1]   Go Down

Author Topic: HELP!!  anyone who can look at a hijackthis l  (Read 9518 times)

0 Members and 1 Guest are viewing this topic.

ruben1506

  • Guest
HELP!!  anyone who can look at a hijackthis l
« on: September 06, 2004, 09:05:46 AM »
OK, got big trouble w/ menu's and homepages that I had nothing to do with getting on my computer.  Can anyone look at a hijackthis log and tell me what the problem(s) are?  I can't seem to get the file on this post, so if someone could tell me how, or give me an email address and I will send it to them.  Thank you very much for your time!

Ruben Lourenco
Logged

Raptor

  • Guest
Re: HELP!!  anyone who can look at a hijackth
« Reply #1 on: September 06, 2004, 09:10:36 AM »
Copy and paste the results.

Rather than having us look at your log, run a program such as

Adaware SE

Or Spybot Search & Destroy

They can do more for you than we can by looking at your log.
Logged

ruben1506

  • Guest
Re: HELP!!  anyone who can look at a hijackth
« Reply #2 on: September 06, 2004, 09:34:14 AM »
Tried to copy and paste the results, but it was too long and would not post.  could I put the file in the post somehow?  Also, have run spybot and these menu bars keep coming up!    
Again, thank you very much for your time!
Logged

Raptor

  • Guest
Re: HELP!!  anyone who can look at a hijackth
« Reply #3 on: September 06, 2004, 10:17:41 AM »
Copy half of the log, post it, then copy the other half and create another post.

As for removing Internet Explorer Toolbars/Plugins

I recommend Advanced Uninstaller Pro 2004

It can do more than uninstall Internet Explorer Toolsbars/Plugins

Quote
This easy-to-use Windows application uninstaller makes your computer run more efficiently by removing software and files that were left behind after you uninstalled software that you no longer use. In addition, the program performs a number of cleanup activities, making your computer more secure
Logged

ruben1506

  • Guest
Re: HELP!!  anyone who can look at a hijackth
« Reply #4 on: September 07, 2004, 06:22:12 AM »
OK, here goes:

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\BearShare\BearShare.exe
C:\Program Files\ICQLite\ICQLite.exe
C:\Program Files\WindowsSA\omniscient.exe
C:\WINDOWS\System32\golum\services.exe
C:\Program Files\BearShare\BearShare.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\dhsvr.exe
C:\Documents and Settings\Ruben\herovan.exe
C:\Documents and Settings\Ruben\xxx.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Ruben\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://nkvd.us (obfuscated)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.coolsearch.biz
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://nkvd.us (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://nkvd.us (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://nkvd.us (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.coolsearch.biz
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.comcast.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://nkvd.us (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast High-Speed Internet
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.ne2.attbb.net
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.emachines.com/
R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://nkvd.us (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://nkvd.us (obfuscated)
R3 - URLSearchHook: (no name) - {5D60FF48-95BE-4956-B4C6-6BB168A70310}_ - (no file)
R3 - URLSearchHook: (no name) - {CFBFAE00-17A6-11D0-99CB-00C04FD64497}_ - (no file)
R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\Program Files\TV Media\TvmBho.dll
F2 - REG:system.ini: UserInit=C:\Windows\System32\wsaupdater.exe,
Logged

ruben1506

  • Guest
Re: HELP!!  anyone who can look at a hijackth
« Reply #5 on: September 07, 2004, 06:24:06 AM »
And Part 2:

O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - C:\WINDOWS\mxTarget.dll
O2 - BHO: (no name) - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll (file missing)
O2 - BHO: (no name) - {30AF3328-E212-7ABC-8254-625579AE2D42} - C:\WINDOWS\System32\twqx.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5FB16413-03EE-4479-B39A-F641C51CCADB} - C:\WINDOWS\System32\iciddeo.dll (file missing)
O2 - BHO: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\Program Files\TV Media\TvmBho.dll
O2 - BHO: (no name) - {7B55BB05-0B4D-44fd-81A6-B136188F5DEB} - C:\WINDOWS\questmod.dll (file missing)
O2 - BHO: (no name) - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\System32\nvms.dll
O2 - BHO: (no name) - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\System32\mscb.dll
O2 - BHO: (no name) - {D848A3CA-0BFB-4DE0-BA9E-A57F0CCA1C13} - C:\WINDOWS\dealhlpr.dll
O2 - BHO: (no name) - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
O2 - BHO: (no name) - {FF1BF4C7-4E08-4A28-A43F-9D60A9F7A880} - C:\WINDOWS\System32\mshelper.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKLM\..\Run: [VTPreset] VTPreset.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [vprzejmoqk] C:\WINDOWS\System32\whkdkct.exe
O4 - HKLM\..\Run: [Windows SA] C:\Program Files\WindowsSA\omniscient.exe
O4 - HKLM\..\Run: [Golum] C:\WINDOWS\System32\golum\services.exe
O4 - HKLM\..\Run: [conscorr] C:\WINDOWS\conscorr.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe
O4 - HKCU\..\Run: [TV Media] C:\Program Files\TV Media\Tvm.exe
O4 - HKCU\..\Run: [Usrr] C:\Documents and Settings\Ruben\Application Data\rncr.exe
O4 - HKCU\..\Run: [Nskutd] C:\WINDOWS\System32\egiah.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -trayboot
Logged

ruben1506

  • Guest
Re: HELP!!  anyone who can look at a hijackth
« Reply #6 on: September 07, 2004, 06:24:55 AM »
And now Part 3:

O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: Crazy Vegas Poker (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: PartyPoker.com (HKLM)
O9 - Extra 'Tools' menuitem: PartyPoker.com (HKLM)
O9 - Extra button: ICQ 4.1 (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O15 - Trusted Zone: *.windupdates.com
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php?bt=ie&p=230270dab455d0e176941480ba0fc85f2978d245429f93809c10f10b815c8a96c9ba5c54063f7603d4945ab86ee97ff22322f046:375a82d108ec2e9d584f880889783bc3
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://active.macromedia.com/director/cabs/sw.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38028.8065509259
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLhelper/version7/dlhelper.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://register3.valueactive.com/mpp_225/webolr/OCX/FlashAX.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab

Logged

Raptor

  • Guest
Re: HELP!!  anyone who can look at a hijackth
« Reply #7 on: September 07, 2004, 06:37:51 AM »
And what kind of problems are you experiencing even after using Adaware SE, Spybot S&D and removing the plugins/toolbars with Advanced Uninstaller Pro 2004?
« Last Edit: September 07, 2004, 06:38:25 AM by Raptor »
Logged

ruben1506

  • Guest
Re: HELP!!  anyone who can look at a hijackth
« Reply #8 on: September 07, 2004, 10:27:39 AM »
Okay, I get pop-up windows that lead to search engine sites (for example, search200.com) and porn sites, and they download desktop Icons to my computer.  I have found .exe files in my C:\Documents and Settings  folder (herovan and xxx) and have deleted them, but return time and time again.  I now have Ad-aware and Spyware Guard on my computer, as well as Norton AV and Spywareblaster.  Again, thank you very much for your time!
Logged

Raptor

  • Guest
Re: HELP!!  anyone who can look at a hijackth
« Reply #9 on: September 07, 2004, 10:54:18 AM »
I suggest you properly configure Adaware SE and allow it to boot at Windows start up. This will allow it to remove things it may not have been able to whilst normally running the program.
Logged

ruben1506

  • Guest
Re: HELP!!  anyone who can look at a hijackth
« Reply #10 on: September 07, 2004, 11:08:29 AM »
Ok, I tried all that, and was STILL having problems   >:(  However, I just installed Spyguard and Sygate PF and now don't seem to have any more troubles  ???  I'll update you in a couple of days and see what happens.  Thanks again for your time and kudos to the best computer forum on the internet!

Logged

Raptor

  • Guest
Re: HELP!!  anyone who can look at a hijackth
« Reply #11 on: September 07, 2004, 11:31:33 AM »
You uninstalled your personal Firewall and now the pop ups stopped?

What kind of popups were you referring to? Ones that required access or ads?

Logged

merlin_2

  • Guest
Re: HELP!!  anyone who can look at a hijackthis l
« Reply #12 on: September 07, 2004, 02:23:33 PM »
you need to ditch bearshare one of the main causes?p2p imho>you need these>http://www.thespykiller.co.uk/ shredder
http://vil.nai.com/vil/stinger/      
trojan killer
http://www.webroot.com
spysweeper..and thats it...and disable system restore to run these programs...ok
« Last Edit: September 07, 2004, 02:24:58 PM by merlin_2 »
Logged
Pages: [1]   Go Up
« previous next »