Member Avatar for Norman

Cant put my finger on it though, but some strange activeX etc has got me suspicious.... Anything you specialists have to say about my hijackthis log?

Logfile of HijackThis v1.99.0
Scan saved at 13:17:14, on 10.10.2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programfiler\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Norman\bin\ZLH.EXE
C:\Programfiler\Microsoft AntiSpyware\gcasServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programfiler\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Programfiler\Skyr@cer Pro Utility\WLANPRO.exe
C:\Programfiler\Microsoft Office\OFFICE11\ONENOTEM.EXE
C:\Programfiler\Rainlendar\Rainlendar.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\crypserv.exe
C:\Programfiler\Fellesfiler\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Norman\Bin\Zanda.exe
C:\Programfiler\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Norman\bin\NJEEVES.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\N R\Mine dokumenter\Backup\HijackThis\HijackThis.exe
C:\Norman\Nvc\bin\nvcoas.exe
C:\Norman\Nvc\BIN\NIP.EXE
C:\Norman\Nvc\BIN\nipsvc.exe
C:\Norman\Nvc\BIN\NVCSCHED.EXE
C:\Norman\Nvc\bin\cclaw.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [gcasServ] "C:\Programfiler\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Programfiler\Fellesfiler\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Programfiler\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Startup: Rainlendar.lnk = C:\Programfiler\Rainlendar\Rainlendar.exe
O4 - Global Startup: Picture Package Menu.lnk = C:\Programfiler\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
O4 - Global Startup: Skyr@cer Pro Configuration Utility.lnk = C:\Programfiler\Skyr@cer Pro Utility\WLANPRO.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programfiler\Fellesfiler\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Crypkey License - Unknown - crypserv.exe (file missing)
O23 - Service: InCD Helper - Nero AG - C:\Programfiler\Ahead\InCD\InCDsrv.exe
O23 - Service: Norman API-hooking helper - Unknown - C:\Norman\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown - C:\Norman\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Unknown - C:\Norman\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: SmartLinkService - Unknown - slserv.exe (file missing)

Anyone?

  • 1 Contributor
  • 1 Reply
  • 126 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by Norman

Dani AI

Generated

— quick appraisal: nothing in the log is an obvious, high‑profile infection, but there are several common‑looking browser helpers and many autorun/service entries that merit verification. Entries left behind by uninstalled software (services showing “file missing”) and unsigned or out‑of‑place processes are the usual causes of the “acting strange” symptoms you described.

Recommended triage (safe, staged approach):

  1. Isolate the machine from the network if data exfiltration is a concern.
  2. Boot Safe Mode and run an up‑to‑date anti‑malware scan (routine scanner + on‑demand tools).
  3. Check for rootkits with a dedicated rootkit scanner.
  4. Use an autorun/process inspection tool to inspect every startup entry and service before removing anything.
  5. Gather suspicious files’ hashes and submit them to a multi‑engine scanner for confirmation.

Tools and references that help with the above:

Practical cautions and next steps: do not use HijackThis “Fix checked” blindly — remove only items that are clearly malicious or proven leftover entries. Prefer Autoruns to uncheck/remove entries, and back up the registry or create a restore point first. Services that report “file missing” usually mean an incomplete uninstall; remove their registry/service entry or reinstall the original software to repair it. If uncertainty remains, post a sanitized log and process snapshots to a specialist malware‑removal community (forensic details help responders), or consider an OS restore from known good media.

Member Avatar for Norman

If there is nothing in the logfile to be worried about I'd be equally interested in hearing that!
So, please, if anyone of you could give me some feedback?

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.