New Posts  All Forums:Forum Nav:

Hijack This results

post #1 of 26
7/18/06 at 2:55pm
Thread Starter 
Hey, my friend has this virus thing thats ****ing up his comp, and making it all slow and giving pop ups and all that shit.

Anyways, ran Hijack This test and these were the log results:

Logfile of HijackThis v1.99.1
Scan saved at 6:41:41 PM, on 7/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton SystemWorks\Norton GoBack\GBPoll.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Ghost\Agent\VProSvc.exe
C:\Program Files\Norton SystemWorks\Norton

AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~1\NORTON~3\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\NORTON~3\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\isnotify.exe
C:\Program Files\ULI5289\ALi5289.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Virgin Net Broadband\Dragdiag.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Labtec\Desktop\V5.1\moffice.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Labtec\Desktop\V5.1\kbdap32a.exe
C:\Program Files\Labtec\Desktop\V5.1\MOUSE32A.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ipwins\ipwins.exe
C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton SystemWorks\Norton

Ghost\Agent\GhostTray.exe
C:\Program Files\Common

Files\{50C39205-0730-1033-0627-050330050001}\Update.exe
C:\DOCUME~1\Tony\MYDOCU~1\CROSOF~1\NTDDE~1.EXE
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Norton SystemWorks\Norton GoBack\GBTray.exe
C:\Program Files\TClock\TClock.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\Security

Console\NSCSRVCE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijack This\HijackThis.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\NAVW32.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://by109fd.bay109.hotmail.msn.co...?fti=yes&curmb

ox=00000000%2d0000%2d0000%2d0000%2d000000000001&a=3c646fce01549162

4521fd5ff38d7801e8ccb66c5c70ed9525f0f8db3ddf632f
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext

= http://www.virgin.net/
O3 - Toolbar: Yahoo! Toolbar -

{EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program

Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} -

(no file)
O3 - Toolbar: Norton AntiVirus -

{C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton

SystemWorks\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ALi5289] C:\Program Files\ULI5289\ALi5289.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI

Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI

Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program

Files\Virgin Net Broadband\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program

Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program

Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program

Files\Labtec\Desktop\V5.1\moffice.exe
O4 - HKLM\..\Run: [OFFICEKB] C:\Program

Files\Labtec\Desktop\V5.1\kbdap32a.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP

Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [IpWins] C:\Program Files\ipwins\ipwins.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec

Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton

SystemWorks\Norton Ghost\Agent\GhostTray.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN

Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Eshe] "C:\WINDOWS\SMANTE~1\scanregw.exe" -vt

yazr
O4 - HKCU\..\Run: [Qnfot]

C:\DOCUME~1\Tony\MYDOCU~1\CROSOF~1\NTDDE~1.EXE
O4 - HKCU\..\Run: [TClock.exe] C:\Program

Files\TClock\tclock_install.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common

Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program

Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program

Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program

Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Norton GoBack.lnk = C:\Program Files\Norton

SystemWorks\Norton GoBack\GBTray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Express Cleanup -

{5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton

SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup -

{5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton

SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Research -

{92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} -

http://yax-download.yazzle.net/Yazzl...cab?refid=1123
O17 -

HKLM\System\CCS\Services\Tcpip\..\{01E1932E-9F4C-4ABB-B6A8-0407F32

A2CEC}: NameServer = 194.168.4.100,194.168.8.100
O17 -

HKLM\System\CS1\Services\Tcpip\..\{01E1932E-9F4C-4ABB-B6A8-0407F32

A2CEC}: NameServer = 194.168.4.100,194.168.8.100
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F}

- C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} -

C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: repairs303169590.dll,lsass.dll
O21 - SSODL: cinnamomum - {93ac7c30-3878-4eaa-9420-7977285df5b1} -

C:\WINDOWS\system32\pmnqguh.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program

Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. -

C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner -

C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec

Corporation - C:\Program

Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec

Corporation - C:\Program Files\Common Files\Symantec

Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec

Corporation - C:\Program Files\Common Files\Symantec

Shared\ccSetMgr.exe
O23 - Service: GoBack Polling Service (GBPoll) - Symantec

Corporation - C:\Program Files\Norton SystemWorks\Norton

GoBack\GBPoll.exe
O23 - Service: GEARSecurity - GEAR Software -

C:\WINDOWS\System32\GEARSec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) -

Macrovision Corporation - C:\Program Files\Common

Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program

Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation -

C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program

Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) -

Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton

AntiVirus\navapsvc.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program

Files\Norton SystemWorks\Norton Ghost\Agent\VProSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service

(NPFMntor) - Symantec Corporation - C:\Program Files\Norton

SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton UnErase Protection (NProtectService) -

Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~3\NPROTECT.EXE
O23 - Service: Norton Protection Center Service (NSCService) -

Symantec Corporation - C:\Program Files\Common Files\Symantec

Shared\Security Console\NSCSRVCE.EXE
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program

Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP -

C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation -

C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) -

Symantec Corporation - C:\Program Files\Common Files\Symantec

Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program

Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation -

C:\PROGRA~1\NORTON~1\NORTON~3\SPEEDD~1\NOPDB.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation -

C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony

Corporation - C:\Program Files\Common Files\Sony

Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec Core LC - Symantec Corporation -

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


Can anyone give any help on this? Need to know whats bad here.
Reply
Reply
post #2 of 26
7/18/06 at 3:26pm
you could try this:
http://hjt.networktechs.com/
http://www.techsupportforum.com/forumdisplay.php?f=50
http://www.tweaksforgeeks.com/ReadHijackThisLog.html
http://hometown.aol.co.uk/jrmc137/hj...l/tutorial.htm
Reply
Reply
post #3 of 26
7/18/06 at 4:59pm
You sure it's a virus and not 50 billion programs all running at the same time that's dragging it down?? that is WAY too many programs to be running, unless he has a Cray of course..
Reply
Reply
post #4 of 26
7/18/06 at 5:01pm
and get rid of windows messenger, that usually kills the pop ups.. worthless program too
Reply
Reply
post #5 of 26
7/18/06 at 5:26pm
Quote:
Originally Posted by dman22
You sure it's a virus and not 50 billion programs all running at the same time that's dragging it down?? that is WAY too many programs to be running, unless he has a Cray of course..
Reply
Reply
post #6 of 26
7/19/06 at 8:12am
Thread Starter 
Thanks for the links chode. Sorry, didnt know this wasnt the right place to post em, im new to this Hijack This thing.

And i dont think its because of all the shit running....it was running fine before. No pop ups, nothing. Even with Live Messenger.

But now its suddenly got loads of pop ups, and slows down after about half an hour of being switched on. Slows down a LOT. Takes about 5 minutes to open up something, no exaggeration.

Anyways, im gonna post the results into the form on that first link and see what happens, thanks for the help
Reply
Reply
post #7 of 26
7/19/06 at 10:39am
Wow...thats a lot of apps running :X
Reply
Reply
post #8 of 26
7/19/06 at 12:06pm
I don't see a problem posting that here and I believe this would be the correct group for that type of question.
I didn't mean there might not also be a virus/spyware running, but all those apps running isn't a good thing and that's gonna kill the performance of even the strongest desktops and laptops.
Has your friend run a virus check and spyware scan?? All that stuff is free and it should solve the problem.
BTW, tell him to stop visiting porn sites
Reply
Reply
post #9 of 26
7/20/06 at 8:44am
Thread Starter 
hah, yeh i could tell him, but i doubt he would listen.

Anyways, he has run a virus and spyware check and for some reason both have failed to find anything. (Adaware SE Personal and Norton Antivirus 2005). Anyways, im gonna go over sometime soon and cut out some of these processes. Hopefully one of them might be the virus....
Reply
Reply
post #10 of 26
7/20/06 at 4:45pm
I'd just do a backup and clean install of the system...start fresh, that gets everything off!
Reply
Reply
post #11 of 26
7/20/06 at 9:51pm
but if he immediately goes to porn sites after the fresh install he's gonna be right back where he started...
Reply
Reply
post #12 of 26
7/21/06 at 2:27am
techsupportforum.com is pretty good imo. i get pretty quick responses. believe me, removing some stubborn viruses is not easy. i went through about a dozen steps to get rid of a few.
Reply
Reply
post #13 of 26
7/22/06 at 5:56pm
Quote:
Originally Posted by Yommeh
Thanks for the links chode. Sorry, didnt know this wasnt the right place to post em, im new to this Hijack This thing.

And i dont think its because of all the shit running....it was running fine before. No pop ups, nothing. Even with Live Messenger.

But now its suddenly got loads of pop ups, and slows down after about half an hour of being switched on. Slows down a LOT. Takes about 5 minutes to open up something, no exaggeration.

Anyways, im gonna post the results into the form on that first link and see what happens, thanks for the help
nah this forum is perfect for posting them. I merely posted the links because there are some helpful tutorials at those sites.
Reply
Reply
post #14 of 26
7/22/06 at 11:20pm
Funny, these p0r|\| things only happen to our friends... you know, it's always a "friend of mine", "my friend", "a friend who isn't me"...
Reply
Reply
post #15 of 26
7/22/06 at 11:26pm
he he, that's very true...
Reply
Reply
post #16 of 26
7/23/06 at 4:33am
can someone help me? a coworker accidentally deleted 1TB of his pr0n, and he needs to get it back.
Reply
Reply
post #17 of 26
7/23/06 at 10:15am
Thread Starter 
LOL, you make a good point.

But i also have some problems from pop ups likely caused by porn, so im not hiding anything

But its not nearly as bad as my friend's. Anyways, not made much progress lately, but if any is made, ill post about it.
Reply
Reply
post #18 of 26
7/23/06 at 10:34am
admitting you have a problem is a good first step. everything should get better soon.








Reply
Reply
post #19 of 26
7/23/06 at 5:22pm
I've gotten a couple of viruses over the past year (though not from porn ) and the MajorGeek forum has been very helpful in aiding me with my problems. http://forums.majorgeeks.com/forumdisplay.php?f=35 Go here and read the tutorial first. It includes some information about commonly used tools for spyware removal and how to use them in conjunction with each other. If these fail, post yout Hijack This data and someone should be able to help you out.
Reply
Reply
post #20 of 26
9/23/06 at 6:22am
You want to know what's bad here? What's bad is that you think anyone would read all that junk.
Reply
Reply
New Posts  All Forums:Forum Nav:
  Return Home