Member Avatar for Karkinnen

can someone just look these over for me? the new hjt found a longer list and im not familiar. i should have it tho once ya help me once.

ps... if one of theme is a norton reminder to resubscribe, can ya tell me so i can turn it off? its driving me batty.


thanks in advance!

Karki

Logfile of HijackThis v1.99.0
Scan saved at 12:31:51 PM, on 12/29/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Norton Personal Firewall\NISUM.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
c:\Program Files\Norton Personal Firewall\ccPxySvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.neopets.com/market.phtml?type=wizard"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\whyvw7c9.slt\)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_06.src"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\whyvw7c9.slt\)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.EXE"
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NAV CfgWiz] c:\PROGRA~1\NORTON~1\Cfgwiz.exe /R
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [IcoSet] c:\hp\bin\cloaker.exe c:\hp\bin\IcoSet\adjust.bat seticon
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) -
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) -
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) -
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{6399DF3E-ED56-433D-93B0-653909B6B114}: NameServer =
O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Proxy Service - Symantec Corporation - c:\Program Files\Norton Personal Firewall\ccPxySvc.exe
O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Personal Firewall Accounts Manager - Symantec Corporation - c:\Program Files\Norton Personal Firewall\NISUM.EXE
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service - Unknown - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

  • 2 Contributors
  • 3 Replies
  • 100 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by dlh6213

Dani AI

Generated

As observed, nothing in the HijackThis snapshot screams "malware." HijackThis is useful for spotting common autostart items, but it is a single-time view and won't catch everything. A few targeted follow-ups will confirm cleanliness and address the recurring Norton subscription pop-up.

Recommended checks and steps:

  1. Update the antivirus product and run a full, up-to-date scan. Add a second-opinion scanner (for example, Malwarebytes Free) and run a full scan as well.
  2. Inspect all autostart points with a comprehensive tool. Autoruns from Sysinternals shows Run keys, services, BHOs, scheduled tasks and more; use the "Hide Microsoft entries" filter and review third-party items carefully. Autoruns (Sysinternals)
  3. For a simpler test, use MSConfig to disable nonessential startup items temporarily and reboot to see if the reminder stops.
  4. Check Scheduled Tasks and the product’s Account/Subscription/Notification settings for an option to silence renewal reminders. Updating the security product often removes stale reminder behavior.
  5. If the reminder cannot be turned off from the product UI, temporarily disabling the notification/autostart entry can stop the popup for testing. Create a system restore point or export the registry before making changes. Do not permanently disable services that are required for protection unless planning to reinstall or replace the product.

A final note: running multiple updated scanners and reviewing Autoruns gives the best confidence. If reminders persist despite updates and settings changes, contact the product vendor for a supported way to suppress subscription notifications or consider clean reinstall of the security suite.

Recommended Answers

All 3 Replies

Member Avatar for dlh6213

I don't see anything bad in your log.

As far as the Norton notice, I find it hard to believe, but it seems that reminder can't be stopped unless you uninstall the program or update it (http://www.dealtime.com/xPR-Symantec_SYMANTEC_Norton_SystemWorks_2004_Professional~RD-158249684612, http://www.gripe2ed.com/scoop/story/2003/5/23/124055/405)

NAV Cfgwiz is a resource hog (according to this ), but they don't recommend removing it here (), so I guess it's up to you on that.

Sorry about the slow response, but it's been rather busy here lately.

Member Avatar for Karkinnen

No worries!! :cheesy: I know ya'll are very busy, and I totally appreciate all your hard work and time!! I tell everyone I know about DaniWeb!!

Happy New Year and Thank you!!!!

Karki ;)

Member Avatar for dlh6213

...I tell everyone I know about DaniWeb!!
Karki ;)

So it's your fault it's been so busy lately!! :D

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.