Member Avatar for JGZ

The mouse has been freezing, pop-ups pop up, and a few other problems. HELP

Logfile of HijackThis v1.99.1
Scan saved at 3:23:30 PM, on 8/20/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\windows\System32\smss.exe
C:\windows\System32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\LEXBCES.EXE
C:\windows\Explorer.EXE
C:\windows\system32\spoolsv.exe
C:\windows\system32\LEXPPS.EXE
C:\windows\System32\SVCHST.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\windows\System32\svchost.exe
C:\Documents and Settings\For Everyone\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: SDWin32 Class - {00123119-6FA0-4701-A842-2B81EF7387C8} - blank (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SDWin32 Class - {FF46C321-727F-4797-861C-81BC8CF31A87} - blank (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Toolbar - {BC97B254-B2B9-4D40-971D-78E0978F5F26}} - (no file)
O3 - Toolbar: (no name) - {BC97B254-B2B9-4D40-971D-78E0978F5F26} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Messenger Plus] "C:\Program Files\Messenger Plus\messplus.exe" -silent
O4 - HKLM\..\Run: [BearShare] C:\Program Files\BearShare\BearShare.exe /pause
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Winsock2 drivers] SVCHST.EXE
O4 - HKLM\..\Run: [EGTSOFT System Locker] C:\Program Files\EGT System Locker\slocker.exe
O4 - HKLM\..\Run: [mmemdrv] C:\windows\System32\mmemdrv.exe /n
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [CSV10P70] C:\Program Files\CSBB\CSv10P070.exe
O4 - HKLM\..\Run: [version] C:\windows\System32\adl_dh.exe
O4 - HKLM\..\Run: [msradl] c:\windows\system32\dpycxgp.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [nnso] C:\windows\System32\nnso.exe
O4 - HKLM\..\Run: [winsync] C:\windows\System32\skgxks.exe reg_run
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKCU\..\RunOnce: [Winsock2 drivers] SVCHST.EXE
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Search -
O9 - Extra button: Instant Buzz - {066040F0-5018-4E15-8AA0-81D36136D989} - C:\windows\System32\shdocvw.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Pager\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Pager\yhexbmes0521.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O15 - Trusted Zone:
O16 - DPF: Tornado 21 -
O16 - DPF: Yahoo! Chat -
O16 - DPF: Yahoo! Dice -
O16 - DPF: Yahoo! Graffiti -
O16 - DPF: Yahoo! Literati -
O16 - DPF: Yahoo! Pool 2 -
O16 - DPF: Yahoo! Towers 2.0 -
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {763C10EE-E4C6-49AA-9325-F15ABF1C52B0} (X1 DownloadControl Class) -
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) -
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) -
O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} -
O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) -
O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) -
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) -
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\windows\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - c:\windows\SvcProc.exe (file missing)

  • 2 Contributors
  • 1 Reply
  • 267 Views
  • 14 Hours Discussion Span
  • Latest Post Latest Post by dlh6213

Dani AI

Generated

The HijackThis output shows a classic adware/malware pattern: many suspicious autorun entries, multiple add-on/toolbars and broken BHO hooks, and several system-like items registered to start from unusual locations. Those symptoms explain the pop-ups and can also cause UI stalls (mouse freezing) when hidden processes or drivers consume CPU/I/O or hook input. Treat the machine as compromised until proven clean.

Recommended cleanup workflow (in order):

  1. Isolate the PC from the network (unplug or disable Wi‑Fi) and back up personal documents and bookmarks (avoid backing up programs or .exe files).
  2. Boot to Safe Mode (F8). If downloads are required, use Safe Mode with Networking but remain isolated if possible.
  3. Run a full scan with an updated antivirus, then run an on‑demand anti‑malware scanner and a rootkit-aware scanner. Quarantine everything flagged and reboot.
  4. Use an autorun inspector (msconfig or a trusted autoruns tool) to disable clearly suspicious startup items; do not delete unknown items until verified. Remove or repair only entries that are clearly broken (for example, BHOs or toolbars shown as "file missing"). Avoid using HijackThis "Fix All" — remove only known bad entries.
  5. After removal, repair networking components and caches:
netsh winsock reset
ipconfig /flushdns
  1. Reboot and re-scan to confirm no reinfection.

Next steps and cautions: as suggested, post fresh scan logs (updated HijackThis plus the anti‑malware/rootkit scan logs) for targeted advice. If instability (mouse freezes) persists after malware removal, investigate hardware/driver causes (test a different mouse, check Device Manager, try driver rollback). Once clean, apply Windows updates and update browser plugins, then change important passwords.

This approach minimizes data loss and avoids risky, blanket removals while giving helpers the cleaned logs they need to recommend precise deletions.

Member Avatar for dlh6213

Hi JGZ, welcome to DaniWeb :D

Please follow the recommendations and instructions in the links below to help prevent reinfection -- during and after the cleanup process (don't skip the Windows Updates), help you do some basic cleanup yourself, and give you some general advice on the use of HijackThis.

When you get to the last one, follow the instructions in Post #5.

If you need help with any of this, please don't hesitate to ask :)

When you're done, please post a new HijackThis log along with the Ewido log.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.