Internet connection problem Hijack This logfile

Question

annelise 0 Newbie Poster

19 Years Ago

Logfile of HijackThis v1.98.2
Scan saved at 04:42:27, on 02.10.2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\WINNT\system32\crypserv.exe
C:\WINNT\SYSTEM32\DNTUS26.EXE
c:\msdm.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINNT\SYSTEM32\THOTKEY.EXE
C:\Programfiler\TOSHIBA\TME2\Tmesrv2.exe
C:\Programfiler\Trend Micro\Internet Security\Tmntsrv.exe
C:\Programfiler\Trend Micro\Internet Security\tmproxy.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Programfiler\Trend Micro\Internet Security\PccPfw.exe
C:\Programfiler\Fellesfiler\Symantec Shared\SymTray.exe
C:\WINNT\system32\TPWRTRAY.EXE
C:\WINNT\system32\Promon.exe
C:\Programfiler\Winamp\Winampa.exe
C:\Programfiler\Java\j2re1.4.2_03\bin\jusched.exe
C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe
C:\WINNT\system32\aightn.exe
C:\WINNT\system32\MSsrvs32.exe
C:\WINNT\system32\fxpflashfix.exe
C:\Programfiler\Trend Micro\Internet Security\pccguide.exe
C:\Programfiler\Trend Micro\Internet Security\PCClient.exe
C:\Programfiler\Trend Micro\Internet Security\TMOAgent.exe
C:\WINNT\system32\internat.exe
C:\WINNT\system32\MSsrvs32.exe
C:\WINNT\system32\fxpflashfix.exe
C:\Programfiler\Spybot - Search & Destroy\TeaTimer.exe
C:\Programfiler\TOSHIBA\NetDevSw\NetDevSW.exe
C:\Programfiler\Microsoft Office\Office\OSA.EXE
C:\Programfiler\Netscape\Netscape\Netscp.exe
C:\WINNT\explorer.exe
C:\My Download Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://home.netscape.com/home/winsearch.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.no/Default.asp?Ath=f
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://home.netscape.com/home/winsearch.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://home.netscape.com/home/winsearch200.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://home.netscape.com/home/winsearch.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://keyword.netscape.com/keyword/%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer fra KPNQwest
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.nettavisen.no/servlets/page?section=1"); (C:\Programfiler\Netscape\Users\rita_skare_peaker\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE
O4 - HKLM\..\Run: [TMESRV.EXE] C:\Programfiler\TOSHIBA\TME2\TMESRV2.EXE /logon
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Programfiler\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [TaskMan] C:\WINNT\SYSTEM32\DLLCACHE\RUNDLL32.EXE
O4 - HKLM\..\Run: [Explorer] C:\WINNT\ServicePackFiles\i386\explorer.exe
O4 - HKLM\..\Run: [SymTray - Norton SystemWorks] C:\Programfiler\Fellesfiler\Symantec Shared\Symtray.exe SetReg
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programfiler\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Configuration Loader] C:\WINNT\SYSTEM32\DLLCACHE\iexplore.exe
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programfiler\Fellesfiler\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Testing 123] C:\WINNT\system32\aightn.exe
O4 - HKLM\..\Run: [Microsoft Video Capture Controls] MSsrvs32.exe
O4 - HKLM\..\Run: [cxbvsavs] fxpflashfix.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Programfiler\Trend Micro\Internet Security\pccguide.exe"
O4 - HKLM\..\Run: [PCClient.exe] "C:\Programfiler\Trend Micro\Internet Security\PCClient.exe"
O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Programfiler\Trend Micro\Internet Security\TMOAgent.exe" /run
O4 - HKLM\..\RunServices: [Microsoft Video Capture Controls] MSsrvs32.exe
O4 - HKLM\..\RunServices: [cxbvsavs] fxpflashfix.exe
O4 - HKLM\..\RunOnce: [SymTray - Norton SystemWorks] C:\Programfiler\Fellesfiler\Symantec Shared\Symtrdr.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [Norton SystemWorks] C:\Programfiler\Fellesfiler\Symantec Shared\CfgWiz.exe /GUID {DA9935BA-22F7-44ee-BD12-BD8B87700BEA}
O4 - HKCU\..\Run: [msddqs] ffeqfit.exe
O4 - HKCU\..\Run: [SVclass32] SVclass32.exe
O4 - HKCU\..\Run: [Microsoft Video Capture Controls] MSsrvs32.exe
O4 - HKCU\..\Run: [cxbvsavs] fxpflashfix.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programfiler\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Office Oppstart.lnk = C:\Programfiler\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Hurtigsøk.lnk = C:\Programfiler\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Network Device Switch.lnk = C:\Programfiler\TOSHIBA\NetDevSw\NetDevSW.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{07FF216C-2077-4E5C-89B6-348620D3AAC9}: NameServer = 193.212.1.11

windows-virus

2 Contributors
1 Reply
83 Views
15 Hours Discussion Span
Latest Post 19 Years Ago Latest Post by crunchie

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 1 · 2004-10-03T08:10:26+00:00

Open Task Manager & end process on the following:
msdm.exe
aightn.exe
MSsrvs32.exe
fxpflashfix.exe

Make certain that those processes have, in fact, stopped.

Then go to C:\ & delete the msdm.exe file manually. Go to WINNT\system32 & delete the others manually.

Close all (browser) windows & rescan with hijackthis. When the scan is finished place a check in the box to the left of the following entries & click 'fix checked':

O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)

O4 - HKLM\..\Run: [Explorer] C:\WINNT\ServicePackFiles\i386\explorer.exe
O4 - HKLM\..\Run: [Configuration Loader] C:\WINNT\SYSTEM32\DLLCACHE\iexplore.exe
O4 - HKLM\..\Run: [Testing 123] C:\WINNT\system32\aightn.exe
O4 - HKLM\..\Run: [Microsoft Video Capture Controls] MSsrvs32.exe
O4 - HKLM\..\Run: [cxbvsavs] fxpflashfix.exe
O4 - HKCU\..\Run: [msddqs] ffeqfit.exe
O4 - HKCU\..\Run: [SVclass32] SVclass32.exe
O4 - HKCU\..\Run: [Microsoft Video Capture Controls] MSsrvs32.exe
O4 - HKCU\..\Run: [cxbvsavs] fxpflashfix.exe

Reboot into safe mode following the instructions here & navigate to & delete the following if found:

C:\WINNT\ServicePackFiles\i386\explorer.exe-file Not the legitimate file in C:\WINNT
C:\WINNT\SYSTEM32\DLLCACHE\iexplore.exe-file Not the legitimate file in C:\WINNT

Reboot normally.

Download sysclean (free) from Trend Micro, allow it to clean up any bad files it finds. It may take a while, so have a cuppa whilst it's running :).

http://www.trendmicro.com/download/dcs.asp

Be sure to download and install the latest pattern file. There's a link to it at the lower left-hand colum of the page. It will not run without the pattern file.

From Trend:

Note that for the Trend Micro Sysclean Package to be effective, you must download and place the latest pattern file in the same folder as the Trend Micro Sysclean Package.

Reboot when done & post another log from hijackthis please.