scanned with hijack. what do I fix??

Question

american212001 0 Newbie Poster

21 Years Ago

Here are a list of my running processes, but i don't know what to get rid of. If somebody could help me out and tell me what is junk i would really appreciate it. :cheesy: thanks

Logfile of HijackThis v1.98.2
Scan saved at 8:13:07 PM, on 10/3/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\WINDOWS\system32\lexpps.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Joe\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {C31DBDF4-0AEB-6D1B-2BE2-0D389CE0889B} - C:\WINDOWS\Lhwaujpv.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.hotmail.com
O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {89D75D39-5531-47BA-9E4F-B346BA9C362C} (CWDL_DownLoadControl Class) -
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} -

microsoft:windows virus-malware

4 Contributors
10 Replies
218 Views
5 Days Discussion Span
Latest Post 21 Years Ago Latest Post by american212001

Dani AI

Generated 7 Months Ago

Good progress so far — pointed you in the right direction with up-to-date anti-spyware scans, and ’s advice about running HijackThis from its own folder and scanning with browsers closed was spot on. If you still have trouble connecting to secure sites in Internet Explorer or to Windows Messenger, those symptoms are commonly caused by leftover proxy/LSP/Winsock changes or a stubborn browser add-on rather than a single visible HijackThis entry. The steps below pick up where the thread left off and focus on restoring network/browsing functionality safely.

Try these checks and quick repairs in this order (back up the registry and create a restore point first):

Run IE with add-ons disabled to see if a BHO/toolbar is the culprit: start Internet Explorer using the "-extoff" switch. If things work, remove recent toolbars/BHOs.
Clear IE SSL state (Internet Options -> Content -> Clear SSL state) and check Tools -> Internet Options -> Connections -> LAN Settings for any proxy entries; disable a proxy unless you intentionally use one.
Reset Winsock and flush DNS to restore the socket stack and cached entries:

netsh winsock reset
ipconfig /flushdns

Reboot after those commands.

Inspect the hosts file (C:\Windows\System32\drivers\etc\hosts) for unexpected redirects and remove any suspicious lines.

If the problem remains:

Use Autoruns (Sysinternals) to examine BHOs, toolbars and startup entries and disable anything unfamiliar. Export any registry keys before deleting.
Reinstall/repair Internet Explorer or Windows Messenger if only those applications show problems.
Re-scan in Safe Mode with updated anti-spyware/antivirus and then re-run HijackThis; post the new log for review.

One more note: some O9 entries referencing missing msjava.dll can be left alone unless you actually installed Microsoft Java (see ’s caution). After you try the above, post the new HijackThis log and a short description of what changed so the next review can be precise.

All 10 Replies

jjorgensen626 30 Junior Poster in Training

21 Years Ago

Download Adaware, Spybot Search & Destroy, and CWShredder (google search)

Make sure you check for update files for the programs, after you install them. CWShredder is a .exe, so as long as you have the current version, there is no update.

These 3 will remove most of the spyware issues you have. Hijackthis is a good tool, but I only use it as a last resort. Espically if you dont know what your looking for. Don't get me wrong, cause Adaware and spybot have been known to cause trouble, but for the most part they are safe.

J-

dlh6213 27 Posting Maven

21 Years Ago

Just a couple of suggestions. After you've done as jorgensen suggested, put HJT in it's own folder -- right now you're running it from your desktop -- it should be in a folder like c:\hjt\hijackthis.exe. Also, before scanning with HJT, close all browser windows (you had Firefox open). Next time you scan with HJT, have it fix all entries that have (no file). Scan again and post a new log.

dlh6213 27 Posting Maven

21 Years Ago

Links to everything jorgensen suggested can be found in this thread:
http://www.daniweb.com/techtalkforums/thread5690.html

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

american212001 0 Newbie Poster · Answer 1 · 2004-10-05T02:37:05+00:00

american212001 0 Newbie Poster

21 Years Ago

thanks for the info. I'll get on that as soon as i can.

american212001 0 Newbie Poster · Answer 2 · 2004-10-05T03:43:06+00:00

If anybody has any further info on this please let me know though.

american212001 0 Newbie Poster · Answer 3 · 2004-10-07T04:46:18+00:00

Logfile of HijackThis v1.98.2
Scan saved at 6:46:26 PM, on 10/6/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\WINDOWS\system32\lexpps.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\HiJackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {C31DBDF4-0AEB-6D1B-2BE2-0D389CE0889B} - C:\WINDOWS\Lhwaujpv.dll
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.hotmail.com
O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} -

Well I did everything, and now this is what I got, so what do ya think? :)

dlh6213 27 Posting Maven Team Colleague · Answer 4 · 2004-10-07T15:05:16+00:00

There are a few more things:
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {C31DBDF4-0AEB-6D1B-2BE2-0D389CE0889B} - C:\WINDOWS\Lhwaujpv.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)

Are you having a problem or just looking for a check-up? Post another log so the pro's can verify you're clean. :)

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 5 · 2004-10-07T18:47:49+00:00

Only fix these if you do not have Java Sun.

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)

Hijackthis has a bug that misinterprets some 09 entries.

american212001 0 Newbie Poster · Answer 6 · 2004-10-07T20:24:03+00:00

Well I am having a problem acessing msn messenger, and secure internet sites with internet explorer, which sucks(I now use Fire Fox, because it does work), and I dont know how to fix those problems, so for now i'm just trying to clean my computer so i can get to work on those later on. I'll post another log later on after i fix those problems. (I'm not using my home computer right now.)

american212001 0 Newbie Poster · Answer 7 · 2004-10-10T02:18:06+00:00

Well here's the new list. Sorry it took me so long to post it.

Logfile of HijackThis v1.98.2
Scan saved at 4:18:47 PM, on 10/9/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\WINDOWS\system32\lexpps.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HiJackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://www.hotmail.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

scanned with hijack. what do I fix??

Dani AI

Recommended Answers Collapse Answers

All 10 Replies

Recommended Answers