Hijack This !!

[Marge]

Am in the middle of sorting a friends PC that seems to be FULL of spyware/junk/rubbish (no it's not bb31 though hers is next to do )

Can someone please have a nosey at the Hijack This log below and tell me what needs to go

Logfile of HijackThis v1.99.1
Scan saved at 16:20:10, on 26/03/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\drivers\dcfssvc.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\WinTools\WToolsA.exe
C:\Program Files\Common Files\WinTools\WSup.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC 2.EXE
C:\WINDOWS\System32\system2.exe
C:\Program Files\Media Access\MediaAccK.exe
C:\Program Files\Media Access\MediaAccess.exe
C:\Program Files\Kodak\KODAK Picture Transfer Software\pts.exe
C:\Program Files\Win Comm\WinComm.exe
C:\Program Files\Win Comm\WinLock.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\ap9h4qmo.exe
c:\temp\salm.exe
C:\Program Files\Toolbar\TBPS.exe
C:\PROGRA~1\Toolbar\PIB.exe
c:\PROGRA~1\Toolbar\radio.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe
C:\PROGRA~1\Toolbar\TBPSSvc.exe
C:\Program Files\Common Files\WinTools\WToolsS.exe
C:\Documents and Settings\Lindsay\Local Settings\Temporary Internet Files\Content.IE5\Z4AISJAW\HijackThis1991[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tiscali.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.tiscali.co.uk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Tiscali
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\nem220.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WinTools\WToolsB.dll
O2 - BHO: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar\toolbar.dll
O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC 2.EXE /P23 "EPSON Stylus C62 Series" /O6 "USB001" /M "Stylus C62"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Bcvsrv32] system2.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\System32\gah95on6.exe
O4 - HKLM\..\Run: [WinTools] C:\PROGRA~1\COMMON~1\WinTools\WToolsA.exe
O4 - HKLM\..\Run: [Win Comm] C:\Program Files\Win Comm\WinComm.exe
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [sdytyd] C:\WINDOWS\sdytyd.exe
O4 - HKLM\..\Run: [ap9h4qmo] C:\WINDOWS\System32\ap9h4qmo.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [TBPS] C:\PROGRA~1\Toolbar\TBPS.exe
O4 - HKLM\..\RunServices: [Bcvsrv32] system2.exe
O4 - HKCU\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC 2.EXE /A "C:\WINDOWS\System32\E_SC.tmp"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: KODAK Picture Transfer Software.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tiscali.co.uk/
O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\ied_s7m.cab
O16 - DPF: {11111111-1111-1111-1111-111191113457} - file://c:\ied_s7.cab
O16 - DPF: {11111111-1111-1111-1111-511111113457} - file://c:\x.cab
O16 - DPF: {11111111-1111-1111-1111-511111113458} - file://c:\x.cab
O16 - DPF: {11111111-1111-1111-1111-511111193457} - file://c:\x.cab
O16 - DPF: {11111111-1111-1111-1111-511111193458} - file://c:\x.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1111847963428
O18 - Protocol: tpro - {FF76A5DA-6158-4439-99FF-EDC1B3FE100C} - C:\PROGRA~1\Toolbar\toolbar.dll
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Dcfssvc - Eastman Kodak Company - C:\WINDOWS\system32\drivers\dcfssvc.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WebSeach Toolbar support NT service (TBPSSvc) - Unknown owner - C:\PROGRA~1\Toolbar\TBPSSvc.exe
O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe
O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe

[danielf]

O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe looks a bit dodgy

O23 - Service: WebSeach Toolbar support NT service (TBPSSvc) - Unknown owner - C:\PROGRA~1\Toolbar\TBPSSvc.exe is spyware as well

as is O23 - Service: WinTools for IE service (WinToolsSvc) - Unknown owner - C:\Program Files\Common Files\WinTools\WToolsS.exe

[Mal]

Originally Posted by danielf

O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe looks a bit dodgy

Have a look here

[danielf]

O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe doesn't look good either

Edit: omg, it really is riddled with spyware. I think half of the entries need to go...
__________________

a little googling suggests the following are nasties as well:

Media Access
wincomm
salm.exe
tbps
pib
radio
tbpssvc.exe

I'm sure there's more

[aliferste]

If it is that bad I would just wipe the the whole thing and start again!

[geminian68]

Hi Marge

The following should be roved:

WToolsA.exe

Description:
wtoolsa.exe is registered as the Adware.Huntbar. is an advertising program. This process monitors your browsing habits and distributes the data back to the author's servers for analysis. This also prompts advertising popups. This program is a registered security risk and should be removed immediately

WSup.exe

Description:
wsup.exe is a hijacker which means it will intermittently change your Internet Explorer settings / Desktop to the link of itââ‚ ¬ÃƒÂ¢Ã¢â‚¬Å¾Ã‚¢s authorââ‚Ã⠀šÃ‚¬ÃƒÂ¢Ã¢â‚¬Å¾Ã‚¢s sponsors. This program is usually installed through consent, however is sometimes packaged as another product. It is a registered security risk and should be removed immediately.

salm.exe

Description:
salm.exe is an advertising program by 180Search. This process monitors your browsing habits and distributes the data back to the author's servers for analysis. This also prompts advertising popups. This program is a registered security risk and should be removed immediately.

tbps.exe

Description:
tbps.exe is a part of WebSearch toolbar, HuntBar parasite variant

HuntBar is a search-hijacker from Traffic Syndicate, with various additional features depending on version.

tbps.exe is Spyware! Remove immediately.

PIB.exe

Description:
PIB.exe is an advertising program. This process monitors your browsing habits and distributes the data back to the author's servers for analysis. This also prompts advertising popups. This program is a registered security risk and should be removed immediately.

TBPSSvc.exe

Description:
TBPSSvc.exe is a part of the Neo Toolbar. There's several variants of this.
TBPSSvc.exe is Spyware! Remove immediately.

wtoolss.exe

Description:
wtoolss.exe is registered as the Adware.Huntbar. is an advertising program. This process monitors your browsing habits and distributes the data back to the author's servers for analysis. This also prompts advertising popups. This program is a registered security risk and should be removed immediately.

00000010-6F7D-442C-93E3-4A4827C2E4C8

Description:
nem219.dll, nem220.dll - DyFuCa/Internet Optimizer, http//www.doxdesk.com/parasite/InternetOptimizer
should be removed immediately.

87766247-311C-43B4-8499-3D5FEC94A183

Description:
WToolsB.dll - HuntBar/Wintools, http//doxdesk.com/parasite/HuntBar.html
should be removed immediately.

8952A998-1E7E-4716-B23D-3DBE03910972

Description:
Toolbar.dll - HuntBar, http//www.doxdesk.com/parasite/HuntBar.html
should be removed immediately.

F4E04583-354E-4076-BE7D-ED6A80FD66DA

Description:
msbe.dll - eXact Advertising,
http//www.doxdesk.com/parasite/BargainBuddy.html
should be removed immediately.

339BB23F-A864-48C0-A59F-29EA915965EC

Description:
toolbar.dll - Huntbar, http//www.doxdesk.com/parasite/HuntBar.html
should be removed immediately.

wtoolsa.exe

Description:
WinTools appears to be a variant of Huntbar. It is very persistent and extremely difficult to remove. It creates its own folder under Program Files/Common Files called WinTools. All of its files appear to be contained within this folder.
should be removed immediately.


WinComm.exe

Description:
wincomm.exe is a process which is registered as the w32.agobot.bg worm. This virus is distributed via the Internet through e-mail and comes in the form of an e-mail message, in the hopes that you open itâ₠¬ÃƒÂ¢Ã¢â‚¬Å¾Ã‚¢s hostile attachment. The worm has itâ₠¬ÃƒÂ¢Ã¢â‚¬Å¾Ã‚¢s own SMTP engine which means it gathers E-mails from your local computer and re-distributes itself. In worst cases this worm can allow attackers to access your computer, stealing passwords and personal data. It is a registered security risk and should be removed immediately.

optimize.exe

Description:
optimize.exe is a virus which is installed by consent from websites, and attempts to dial expensive pornography servers. This program is a registered security risk and should be removed immediately.

bargains.exe

Description:
bargains.exe is a spyware which generates pop-up advertisements and analyses your computer usage for analysis by Exact Advertising. This program is a registered security risk and should be removed immediately.

ctfmon.exe

Description:
ctfmon.exe is a part of the Microsoft Office suite. It activates the Alternative User Input Text Input Processor (TIP) and the Microsoft Office XP Language Bar. This program is a non-essential system process, but should not be terminated unless suspected to be causing problems.

TBPSSvc.exe

TBPSSvc.exe is a part of the Neo Toolbar. There's several variants of this. Please use our HJT log analyzer and HJT forum to make sure you get rid of it all.
TBPSSvc.exe is Spyware! and should be removed immediately.

wtoolss.exe

Description:
wtoolss.exe is registered as the Adware.Huntbar. is an advertising program. This process monitors your browsing habits and distributes the data back to the author's servers for analysis. This also prompts advertising popups. This program is a registered security risk and should be removed immediately.

zeta.exe

Description:
What does it do?

Details are sketchy, and it seems ZESOFT, the owners of the zeta.exe file, are no longer in business (atleast, zesoft.com doesn't seem to be working). According to this page on Paretologic.com, ZESOFT are associated with adware, specifically the AdWare.P2PNetworking, however zeta.exe itself is not mentioned there but it is adware regardless, probably just another name for the same AdWare.P2PNetworking, perhaps to create confusion.

I hope this helps you

[goldoni]

Why donââ‚Âà ‚¬ÃƒÂ¢Ã¢â‚¬Å¾Ã‚¢t you download Adaware and update, then re-start the PC in safe mode and run the programme it should get all of that or you could try the new Microsoft version. Then run highjack this and re-post.

[Marge]

Originally Posted by goldoni

Why donââ‚Âà ‚¬ÃƒÂ¢Ã¢â‚¬Å¾Ã‚¢t you download Adaware and update, then re-start the PC in safe mode and run the programme it should get all of that or you could try the new Microsoft version. Then run highjack this and re-post.

Lol have done that first bit already, Adaware picked up 864 critical objects

I'm off out but thanks to everyone for their kind help, I'll be back later to start round 2 on it

[bb31]

Originally Posted by Marge

I'm off out but thanks to everyone for their kind help, I'll be back later to start round 2 on it

do mine when u finished that!! you know u love it

[greencreeper]

A good rule of thumb is that nothing should be running from the temp folder, so wipe all temp folders - c:\temp c:\win(nt/dows)\temp and the temp folders in user profiles. Also be suspicious of anything in system32. I find Spybot's tools a big help in checking BHOs - it tells you if they are dodgy. Ditto programs set to run on startup. It's process list is more detailed too.

Salm is a nasty - got rid of that off a PC only yesterday.

[Tezcatlipoca]

Originally Posted by Marge

Lol have done that first bit already, Adaware picked up 864 critical objects

And the stuff HiJackThis is picking up is after you've used AdAware to clean stuff out?


Have you tried Spybot S&D too?



Although, I think aliferste's idea may be worth a look if there's that much crap on it.....

[jtwn]

OK, i'm going to recommend something else, quicker and more efficient than spybot, imo.

http://download.microsoft.com/downlo...areInstall.exe

[greencreeper]

Originally Posted by jtwn

OK, i'm going to recommend something else, quicker and more efficient than spybot, imo.

http://download.microsoft.com/downlo...areInstall.exe

Not for Windows 98 though. Just as well Windows 98 doesn't get spy/malware

[Marge]

Originally Posted by jtwn

OK, i'm going to recommend something else, quicker and more efficient than spybot, imo.

http://download.microsoft.com/downlo...areInstall.exe

Thanks for the link, has certainly proved useful. Below is a screen shot of the result, look away if easily frightened

[goldoni]

So it looks like the Microsoft version does work and if this is after running Adaware that did not find these. Is this is a record. The worst one I have done had 186 files

Nice one.