hijack this log file analysis urgently required!
 

hi all, thought i posted a thread about this before.now im more paranoid than ever lol.been playing a game where ive been hacked in game and outside game.active ports program keeps picking up ips belonging to the game server i used to play even though the o/s has been freshly installed and the game,comanche 4 is no longer and has never been on this new o/s!unfortunately active ports doesnt create a log file.so posting my hijack this file for urgent attention by those who can decifer it.please let me know as soon as possible!i am under attack!(lol sounds like a friggin movie).jokes,aside this situation is really getting on my nerves as i dont have the ability to deflect theses attacks.also if any one can inform me of what legal steps could be taken.thanks very much.your help will be more than appreciated.cheers.log file enclosed.thanks.p.s.any way to hunt hidden programs that may be on my pc trying to communicate through outbound traffic?again,cheers.

Logfile of HijackThis v1.99.1
Scan saved at 17:02:23, on 22/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
D:\WINDOWS\System32\CTsvcCDA.exe
D:\WINDOWS\System32\nvsvc32.exe
D:\WINDOWS\system32\ZoneLabs\vsmon.exe
D:\WINDOWS\System32\MsPMSPSv.exe
D:\WINDOWS\Explorer.EXE
D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
D:\WINDOWS\system32\CTHELPER.EXE
D:\Program Files\Messenger\msmsgs.exe
D:\Program Files\MSN Messenger\MsnMsgr.Exe
D:\Program Files\Creative\MediaSource\GO\CTCMSGo.exe
D:\Program Files\SpywareGuard\sgmain.exe
D:\Program Files\SpywareGuard\sgbhp.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Active Ports\aports.exe
D:\DOCUME~1\MIKEPR~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - D:\Program Files\SpywareGuard\dlprotect.dll
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTSysVol] D:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] D:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTStartup] "D:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE" /run
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Creative MediaSource Go] D:\Program Files\Creative\MediaSource\GO\CTCMSGo.exe /SCB
O4 - Startup: SpywareGuard.lnk = D:\Program Files\SpywareGuard\sgmain.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1140572158702
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - D:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WINDOWS\system32\ZoneLabs\vsmon.exe

Re: hijack this log file analysis urgently required!
 

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE

BACKUP ALL ITEMS BEFORE REMOVING...

Then run webroot spysweeper

Mike

Re: hijack this log file analysis urgently required!
 

nwiz.exe is Related to the Nvidia company...I dont see why you need to get rid of this.

More info - http://www.neuber.com/taskmanager/process/nwiz.exe.html

Re: hijack this log file analysis urgently required!
 

I have it on my other computer and I removed it, it was just slowing down my CPU, besides you can always add it back.

Re: hijack this log file analysis urgently required!
 

ok will do,thanks alot dude for replying.getting loads of unkown connections in my active ports program all stemming from this game i used to play.need help real bad.will do as instructed in the meantime even though i reinstalled o/s again.even changed ips by swithing models to usb.but as soon as i did with fresh o/s installed,i saw the server ips to the game i used to play trying to connect to my pc via ports 80 ,1070 and others.if you can help let me know.i wil put another post about this particualr attacks up later.thanks dude.really weighing me down not knowing how to combat it.for your info i got belkin fd57231-4uk high speed mode router,zone alarm pro,avg free edition as you know from log file.needless to say i know you must be busy.but if you know what to do and can kindly again take the time to respond and advise then i can only say a big thans to ya and buy you a virtual beer on me!better than nothing lol!best wishes mate.mike.

Re: hijack this log file analysis urgently required!
 

sorry to bother you again.dont know where to find or execute files you mentioned.could you let me know how.i tried.cheers.preciate it.best wishes.

Re: hijack this log file analysis urgently required!
 

i agree and know its related to nvidia.ct file belong to creative audigy too.my main problem is hackers connecting to my pc thru ports 80 and 1000 range,trojan preferences.got active ports program but sometimes it takes ages to execute.any help on this issue dude?thanks alot.off to bed 4 am here.spent most of the night terminating ips from old game servers i used to play on and not enjoying new game call of duty 2.why do people live ot harass others in their few spare hours i will never,never know.best wishes.mike.least i got some help now though.:-)