Member Avatar for steosaur(oWn)

ive been getting spyware problems recently that adawre and spybot arent detecting (up to date too)
can someone take a look at this and tell me whats bad?
or just any suggestions, when i leave my computer i come back with like 20 pop ups

Logfile of HijackThis v1.97.7
Scan saved at 6:25:53 PM, on 2/24/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\carpserv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HPQ\One-Touch\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\wt\updater\wcmdmgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\PeerGuardian pr14\PeerGuardian_1.99b_pr14.exe
C:\Program Files\Soulseek\slsk.exe
C:\Documents and Settings\Steven\Application Data\cacp.exe
C:\WINDOWS\System32\wnsapisv.exe
C:\Documents and Settings\Steven\Desktop\PrimaryFolder\Applications\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - c:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
O4 - HKLM\..\Run: [QT4HPOT] C:\Program Files\HPQ\One-Touch\OneTouch.EXE
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [wcmdmgr] C:\WINDOWS\wt\updater\wcmdmgrl.exe -launch
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Lerm] C:\Documents and Settings\Steven\Application Data\cacp.exe
O4 - HKCU\..\Run: [WNST] C:\WINDOWS\System32\wnsapisv.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: MoneySide (HKLM)
O14 - IERESET.INF: START_PAGE_URL=
O16 - DPF: Yahoo! Euchre -
O16 - DPF: Yahoo! Poker -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

  • 3 Contributors
  • 4 Replies
  • 193 Views
  • 1 Year Discussion Span
  • Latest Post Latest Post by steosaur(oWn)

Dani AI

Generated

This thread is a textbook XP-era adware/spyware case: posted a HijackThis log and reported many pop-ups that common scanners missed, offered help, and the OP later noted the problem was resolved. The short, practical checklist below is meant as a focused cleanup and prevention summary for anyone who stumbles on this thread later.

  1. Isolate and back up. Disconnect the PC from the network, copy user documents to removable media (do not run executables from that media), and make a disk image or full backup before changing system files.
  2. Diagnose in Safe Mode. Boot to Safe Mode (or Safe Mode with Networking if needed), then use a process tool such as Process Explorer to identify and stop obviously malicious processes. rkill can help stop active malware to allow scans to finish.
  3. Layered scanning and rootkit checks. Run multiple up-to-date scanners (on-demand AV + Anti-Malware) and a rootkit detector (GMER/RootkitRevealer/TDSSKiller). Repeat scans after reboots and after disabling startup items.
  4. Inspect startups safely. Use autoruns to examine HKLM/HKCU Run keys, services and BHOs; use HijackThis strictly for logging and learning—avoid “fix all” without confirming each entry. Disable suspicious startups first, then remove files once confirmed.
  5. Recovery plan. If instability continues or core system files are affected, prefer a clean OS reinstall from known-good media and restore only scanned backups. After cleanup, change all account passwords from a clean machine.

When reviewing logs, prioritize entries with no valid path, executables running from user Temp or Application Data, blank or duplicate BHOs, and unexpected services. Always document any registry/file changes and create a restore point or image beforehand. Finally, patch the OS, remove unnecessary P2P or risky software, run with least privilege, and change credentials after a confirmed clean.

Recommended Answers

All 4 Replies

Member Avatar for OurNation

Well I'm sorry this got ignored but if you want I can help.

Member Avatar for crunchie

OurNation. Where did you unearth this one from :). 25/02/2004 :D.

Member Avatar for OurNation

Just seeing if he still needed help.

Member Avatar for steosaur(oWn)

hmm i dont even remember posting this, haha thanks for the help, but ive learned a whole lot since then and I am fine.
~thanks anyway

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.