|
Hijack This !!
Am in the middle of sorting a friends PC that seems to be FULL of spyware/junk/rubbish (no it's not bb31 though hers is next to do :erm: )
Can someone please have a nosey at the Hijack This log below and tell me what needs to go Logfile of HijackThis v1.99.1 Scan saved at 16:20:10, on 26/03/2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\drivers\dcfssvc.exe C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Norton AntiVirus\SAVScan.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\WinTools\WToolsA.exe C:\Program Files\Common Files\WinTools\WSup.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC 2.EXE C:\WINDOWS\System32\system2.exe C:\Program Files\Media Access\MediaAccK.exe C:\Program Files\Media Access\MediaAccess.exe C:\Program Files\Kodak\KODAK Picture Transfer Software\pts.exe C:\Program Files\Win Comm\WinComm.exe C:\Program Files\Win Comm\WinLock.exe C:\WINDOWS\System32\ctfmon.exe C:\WINDOWS\System32\ap9h4qmo.exe c:\temp\salm.exe C:\Program Files\Toolbar\TBPS.exe C:\PROGRA~1\Toolbar\PIB.exe c:\PROGRA~1\Toolbar\radio.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe C:\PROGRA~1\Toolbar\TBPSSvc.exe C:\Program Files\Common Files\WinTools\WToolsS.exe C:\Documents and Settings\Lindsay\Local Settings\Temporary Internet Files\Content.IE5\Z4AISJAW\HijackThis1991[1].exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.co.uk/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tiscali.co.uk/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Tiscali R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem220.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar\toolbar.dll O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC 2.EXE /P23 "EPSON Stylus C62 Series" /O6 "USB001" /M "Stylus C62" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE O4 - HKLM\..\Run: [Bcvsrv32] system2.exe O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\System32\gah95on6.exe O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe O4 - HKLM\..\Run: [Win Comm] C:\Program Files\Win Comm\WinComm.exe O4 - HKLM\..\Run: [salm] c:\temp\salm.exe O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe" O4 - HKLM\..\Run: [sdytyd] C:\WINDOWS\sdytyd.exe O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4qmo.exe O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe O4 - HKLM\..\RunServices: [Bcvsrv32] system2.exe O4 - HKCU\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC 2.EXE /A "C:\WINDOWS\System32\E_SC.tmp" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - Global Startup: KODAK Picture Transfer Software.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll O14 - IERESET.INF: START_PAGE_URL=http://www.tiscali.co.uk/ O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\ied_s7m.cab O16 - DPF: {11111111-1111-1111-1111-111191113457} - file://c:\ied_s7.cab O16 - DPF: {11111111-1111-1111-1111-511111113457} - file://c:\x.cab O16 - DPF: {11111111-1111-1111-1111-511111113458} - file://c:\x.cab O16 - DPF: {11111111-1111-1111-1111-511111193457} - file://c:\x.cab O16 - DPF: {11111111-1111-1111-1111-511111193458} - file://c:\x.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1111847963428 O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - C:\PROGRA~1\Toolbar\toolbar.dll O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: WebSeach Toolbar support NT service (TBPSSvc) - Unknown owner - C:\PROGRA~1\Toolbar\TBPSSvc.exe O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe |
Re: Hijack This !!
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe looks a bit dodgy
O23 - Service: WebSeach Toolbar support NT service (TBPSSvc) - Unknown owner - C:\PROGRA~1\Toolbar\TBPSSvc.exe is spyware as well as is O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe |
Re: Hijack This !!
Quote:
|
Re: Hijack This !!
O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe doesn't look good either
Edit: omg, it really is riddled with spyware. I think half of the entries need to go... __________________ a little googling suggests the following are nasties as well: Media Access wincomm salm.exe tbps pib radio tbpssvc.exe I'm sure there's more :erm: |
Re: Hijack This !!
If it is that bad I would just wipe the the whole thing and start again!
|
Re: Hijack This !!
Hi Marge
The following should be roved: WToolsA.exe Description: wtoolsa.exe is registered as the Adware.Huntbar. is an advertising program. This process monitors your browsing habits and distributes the data back to the author's servers for analysis. This also prompts advertising popups. This program is a registered security risk and should be removed immediately WSup.exe Description: wsup.exe is a hijacker which means it will intermittently change your Internet Explorer settings / Desktop to the link of itââ‚ ¬ÃƒÂ¢Ã¢â‚¬Å¾Ã‚¢s authorââ‚Ã⠀šÃ‚¬ÃƒÂ¢Ã¢â‚¬Å¾Ã‚¢s sponsors. This program is usually installed through consent, however is sometimes packaged as another product. It is a registered security risk and should be removed immediately. salm.exe Description: salm.exe is an advertising program by 180Search. This process monitors your browsing habits and distributes the data back to the author's servers for analysis. This also prompts advertising popups. This program is a registered security risk and should be removed immediately. tbps.exe Description: tbps.exe is a part of WebSearch toolbar, HuntBar parasite variant HuntBar is a search-hijacker from Traffic Syndicate, with various additional features depending on version. tbps.exe is Spyware! Remove immediately. PIB.exe Description: PIB.exe is an advertising program. This process monitors your browsing habits and distributes the data back to the author's servers for analysis. This also prompts advertising popups. This program is a registered security risk and should be removed immediately. TBPSSvc.exe Description: TBPSSvc.exe is a part of the Neo Toolbar. There's several variants of this. TBPSSvc.exe is Spyware! Remove immediately. wtoolss.exe Description: wtoolss.exe is registered as the Adware.Huntbar. is an advertising program. This process monitors your browsing habits and distributes the data back to the author's servers for analysis. This also prompts advertising popups. This program is a registered security risk and should be removed immediately. 00000010-6F7D-442C-93E3-4A4827C2E4C8 Description: nem219.dll, nem220.dll - DyFuCa/Internet Optimizer, http//www.doxdesk.com/parasite/InternetOptimizer should be removed immediately. 87766247-311C-43B4-8499-3D5FEC94A183 Description: WToolsB.dll - HuntBar/Wintools, http//doxdesk.com/parasite/HuntBar.html should be removed immediately. 8952A998-1E7E-4716-B23D-3DBE03910972 Description: Toolbar.dll - HuntBar, http//www.doxdesk.com/parasite/HuntBar.html should be removed immediately. F4E04583-354E-4076-BE7D-ED6A80FD66DA Description: msbe.dll - eXact Advertising, http//www.doxdesk.com/parasite/BargainBuddy.html should be removed immediately. 339BB23F-A864-48C0-A59F-29EA915965EC Description: toolbar.dll - Huntbar, http//www.doxdesk.com/parasite/HuntBar.html should be removed immediately. wtoolsa.exe Description: WinTools appears to be a variant of Huntbar. It is very persistent and extremely difficult to remove. It creates its own folder under Program Files/Common Files called WinTools. All of its files appear to be contained within this folder. should be removed immediately. WinComm.exe Description: wincomm.exe is a process which is registered as the w32.agobot.bg worm. This virus is distributed via the Internet through e-mail and comes in the form of an e-mail message, in the hopes that you open itââ‚ ¬ÃƒÂ¢Ã¢â‚¬Å¾Ã‚¢s hostile attachment. The worm has itââ‚ ¬ÃƒÂ¢Ã¢â‚¬Å¾Ã‚¢s own SMTP engine which means it gathers E-mails from your local computer and re-distributes itself. In worst cases this worm can allow attackers to access your computer, stealing passwords and personal data. It is a registered security risk and should be removed immediately. optimize.exe Description: optimize.exe is a virus which is installed by consent from websites, and attempts to dial expensive pornography servers. This program is a registered security risk and should be removed immediately. bargains.exe Description: bargains.exe is a spyware which generates pop-up advertisements and analyses your computer usage for analysis by Exact Advertising. This program is a registered security risk and should be removed immediately. ctfmon.exe Description: ctfmon.exe is a part of the Microsoft Office suite. It activates the Alternative User Input Text Input Processor (TIP) and the Microsoft Office XP Language Bar. This program is a non-essential system process, but should not be terminated unless suspected to be causing problems. TBPSSvc.exe TBPSSvc.exe is a part of the Neo Toolbar. There's several variants of this. Please use our HJT log analyzer and HJT forum to make sure you get rid of it all. TBPSSvc.exe is Spyware! and should be removed immediately. wtoolss.exe Description: wtoolss.exe is registered as the Adware.Huntbar. is an advertising program. This process monitors your browsing habits and distributes the data back to the author's servers for analysis. This also prompts advertising popups. This program is a registered security risk and should be removed immediately. zeta.exe Description: What does it do? Details are sketchy, and it seems ZESOFT, the owners of the zeta.exe file, are no longer in business (atleast, zesoft.com doesn't seem to be working). According to this page on Paretologic.com, ZESOFT are associated with adware, specifically the AdWare.P2PNetworking, however zeta.exe itself is not mentioned there but it is adware regardless, probably just another name for the same AdWare.P2PNetworking, perhaps to create confusion. I hope this helps you ;) |
Re: Hijack This !!
Why donââ‚Âà ‚¬ÃƒÂ¢Ã¢â‚¬Å¾Ã‚¢t you download Adaware and update, then re-start the PC in safe mode and run the programme it should get all of that or you could try the new Microsoft version. Then run highjack this and re-post.
|
Re: Hijack This !!
Quote:
I'm off out but thanks to everyone for their kind help, I'll be back later to start round 2 on it :fit: |
Re: Hijack This !!
Quote:
do mine when u finished that!! you know u love it ;) |
Re: Hijack This !!
A good rule of thumb is that nothing should be running from the temp folder, so wipe all temp folders - c:\temp c:\win(nt/dows)\temp and the temp folders in user profiles. Also be suspicious of anything in system32. I find Spybot's tools a big help in checking BHOs - it tells you if they are dodgy. Ditto programs set to run on startup. It's process list is more detailed too.
Salm is a nasty - got rid of that off a PC only yesterday. |
Re: Hijack This !!
Quote:
And the stuff HiJackThis is picking up is after you've used AdAware to clean stuff out? Have you tried Spybot S&D too? Although, I think aliferste's idea may be worth a look if there's that much crap on it..... |
Re: Hijack This !!
OK, i'm going to recommend something else, quicker and more efficient than spybot, imo.
http://download.microsoft.com/downlo...areInstall.exe |
Re: Hijack This !!
Quote:
|
Re: Hijack This !!
1 Attachment(s)
Quote:
|
Re: Hijack This !!
So it looks like the Microsoft version does work and if this is after running Adaware that did not find these. Is this is a record. The worst one I have done had 186 files
Nice one. |
Re: Hijack This !!
Goldoni, you're right but I do think it's another in the line of defence. Personally I'm runnng Spybot, Adaware, Spywareblaster, Norton and MS - not one of the them picks up everything.
|
Re: Hijack This !!
|
Re: Hijack This !!
Quote:
She'd only had the puter almost 3 years, never had a firewall, AV software, nothing. Mad...... :dozey: :disturbd: |
Re: Hijack This !!
Many of the PCs I deal with, which have access to clinical data, have either no AV software or ineffective AV software, and very rarely have any spy/mal-ware protection. Users are typically unware of the dangers. OS patching just doesn't happen unless XP has been accidentally configured to download and install patches. Customers general awareness of and attitude towards security is poor. On Friday I cleaned a PC of 85 malicious programs - the problem initially presented itself as something else entirely. Alarm bells started ringing when I found salm running from the temp directory. Frightening.
|
Re: Hijack This !!
Try here for an online analysis of your HiJack This log :)
|
Re: Hijack This !!
Quote:
|
Re: Hijack This !!
sorry to hijack this thread, but i am on my daughters pc and allsorts is on here and its so slow. ive run hijack this and bought up the following results, before u hit the delete key on all of them, is there any kind ppl out there who could tell me which ones definately to delete?Logfile of HijackThis v1.99.1
Scan saved at 20:50:11, on 20/03/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\acs.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\Ati2evxx.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\SAVScan.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\COMMON~1\XCPCSync\TRANSL~1\ErPhn2\ErTr ay.exe C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\LTSMMSG.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe c:\progra~1\intern~1\iexplore.exe C:\Program Files\D-Link AirPlus Xtreme G\AirPlus.exe C:\Program Files\FinePixViewer\QuickDCF.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-aware.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\kirstie\Local Settings\Temporary Internet Files\Content.IE5\3G4NTX45\HijackThis1991[1].exe C:\Program Files\Messenger\msmsgs.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.uelyhwrczezvegvxuyfzruhh....ssb1d9vYy7.jpg R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/cust...//my.yahoo.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [XTNDConnect PC - ErPhn2] C:\PROGRA~1\COMMON~1\XCPCSync\TRANSL~1\ErPhn2\ErTr ay.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [LTSMMSG] LTSMMSG.exe O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Bend option once less] C:\Documents and Settings\All Users\Application Data\CDROM PROXY BEND OPTION\typelite.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - Global Startup: ACS.lnk = ? O4 - Global Startup: D-Link AirPlus Xtreme G Configuration Utility.lnk = ? O4 - Global Startup: D-Link REG Utility.lnk = ? O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe O4 - Global Startup: hp psc 1000 series.lnk = ? O4 - Global Startup: hpoddt01.exe.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary...r.cab31267.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-18.cab O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1093710524087 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/p...le/install.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{DC9B380D-097E-48DF-8A07-6A5158B73AB4}: NameServer = 62.241.160.200 158.43.240.4 O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe also loads of popups are on and popup blocked is switched on |
Re: Hijack This !!
Run Spybot - nothing to interpret then.
Delete the QoS component from the LAN connection, and run a chkdsk /f when you've finished cleaning the PC. Disable power management for the NIC. |
| All times are GMT. The time now is 18:53. |
Powered by vBulletin® Version 3.8.11
Copyright ©2000 - 2026, vBulletin Solutions Inc.
All Posts and Content are © Cable Forum