helpless amish guy/ HJT scan log

Question

katanashi 0 Newbie Poster

20 Years Ago

i know u people must get tired of people like me, but i am no good with computers. please, could someone look at my hijack scan log

Logfile of HijackThis v1.99.1
Scan saved at 12:50:38 AM, on 10/20/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\perfcl.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\SPYWAR~2\swdoctor.exe
C:\PROGRA~1\WINZIP\wzqkpick.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Erikka\My Documents\Unzipped\hijackthis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
R3 - URLSearchHook: (no name) - _{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\rrfoy.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\rrfoy.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PerformCl] C:\WINDOWS\System32\perfcl.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Search -
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: IEpal - CleanUp history, search and navigation - {75B4AE98-6967-4BFA-A254-3538918685AC} - C:\Program Files\IEpal\CIEpal.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: IEpal - Analyze page - {FA995425-8FB1-4692-A323-69A160117172} - C:\Program Files\IEpal\IEpal.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Microsoft AntiSpyware helper - {0D416680-8653-48A5-B37E-319FB2EA4F0B} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {0D416680-8653-48A5-B37E-319FB2EA4F0B} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {1B5A32D3-D89B-4BD2-9BEF-231F56056073} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {1B5A32D3-D89B-4BD2-9BEF-231F56056073} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {1DF48C15-ED01-41A6-A638-024C9BADC8F6} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {1DF48C15-ED01-41A6-A638-024C9BADC8F6} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {2769837E-1EC7-4309-8FF3-18BF5462537A} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {2769837E-1EC7-4309-8FF3-18BF5462537A} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {3DF2777B-583A-455B-95C6-DF1EDAD53FE3} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {3DF2777B-583A-455B-95C6-DF1EDAD53FE3} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {594A74BF-8BE4-4412-B536-1E624C717F6B} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {594A74BF-8BE4-4412-B536-1E624C717F6B} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {60BB2E04-7F6E-478A-8CF5-441AE74B1CFD} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {60BB2E04-7F6E-478A-8CF5-441AE74B1CFD} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {75C6640F-54B4-4CD4-96C7-FB4ECC264015} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {75C6640F-54B4-4CD4-96C7-FB4ECC264015} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {78003E54-581F-4EF2-B465-24F2FFF5715E} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {78003E54-581F-4EF2-B465-24F2FFF5715E} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {788623AD-E837-4916-BF36-E80BF6F90D80} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {788623AD-E837-4916-BF36-E80BF6F90D80} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {7A8B98D4-99BB-406B-810D-961B08183E69} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {7A8B98D4-99BB-406B-810D-961B08183E69} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {7E62E898-BFC9-4B75-9190-949D980A435C} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {7E62E898-BFC9-4B75-9190-949D980A435C} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {7EB119FD-ACAB-42E8-B944-3E062469338D} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {7EB119FD-ACAB-42E8-B944-3E062469338D} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {A142EDA5-59B1-4080-8499-0483F234F08B} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {A142EDA5-59B1-4080-8499-0483F234F08B} - (no file) (HKCU)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (file missing) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {E2294B2B-F86E-4129-9912-80A634BC8F6C} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {E2294B2B-F86E-4129-9912-80A634BC8F6C} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {E37D1681-D063-4A4E-8276-0B4CF8ABF67E} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {E37D1681-D063-4A4E-8276-0B4CF8ABF67E} - (no file) (HKCU)
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {10ABAAE7-6D4D-142E-D23E-6BE616628001} -
O16 - DPF: {11111111-1111-1111-1111-111191113457} - file://c:\ied_s7.cab
O16 - DPF: {11111111-1111-1111-1111-611111193457} - file://c:\wx.cab
O16 - DPF: {11111111-1111-1111-1111-611111193458} - file://c:\wx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BFF188D8-6633-4065-A931-33B129FC812B}: NameServer = ,
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O21 - SSODL: NTDBGTOOL - {C40C1FF6-CBDC-4871-AF57-E97F835D325C} - C:\WINDOWS\System32\c_28rpol.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Power Manager (PowerManager) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)
O23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINDOWS\System32\wdfmgr.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

microsoft virus-malware

2 Contributors
2 Replies
283 Views
1 Day Discussion Span
Latest Post 20 Years Ago Latest Post by katanashi

Dani AI

Generated 9 Months Ago

Brief expert summary: the HijackThis output posted by shows signs commonly associated with DNS hijacks plus browser‑side add‑ons that load at startup (BHOs/SSODL/Downloaded ActiveX). Those two problems together frequently cause failures when connecting to HTTPS sites (DNS redirection or a malicious BHO intercepting navigation). (en.wikipedia.org)

Immediate, ordered actions (safe-first):

Isolate the PC (unplug network or disable the adapter) and back up important personal files to removable media.
On a clean machine create rescue media (bootable scanner) and a copy of up‑to‑date on‑demand tools (Malwarebytes/AdwCleaner). Boot the infected PC from rescue media if possible and run a full scan; otherwise boot to Safe Mode (no networking) and run on‑demand scanners. (support.kaspersky.com)

Networking repairs (run after cleaning):

Inspect current DNS and hosts; flush caches and reset the network stack. Example commands (run from an elevated command prompt; adapter name may differ):
```
ipconfig /all
type C:\Windows\System32\drivers\etc\hosts
ipconfig /flushdns
netsh winsock reset
netsh interface ip set dns "Local Area Connection" dhcp
```
Resetting Winsock and flushing DNS often clears network problems caused by layered network hooks. (learn.microsoft.com)

Notes and cautions:

Do not randomly remove HijackThis lines without knowing what they do; use HJT backups or an experienced remover. HJT entries O16/O17/O21 correspond to Downloaded ActiveX, altered NameServer entries and SSODL autoruns — each must be handled according to context. If removal is uncertain, prefer offline rescue scanning and uninstalling unwanted toolbars via normal Add/Remove before editing the registry. (aumha.org)
If the machine is very old (Windows XP / IE6 era), lack of modern TLS/SNI support can also prevent HTTPS even after cleaning; upgrading the OS/browser (or using a modern browser on a supported OS) is the long‑term fix. (rfc-editor.org)

Practical next steps for this thread: prioritize isolation, an offline rescue scan, then the network resets above; after that, re-run HijackThis and post an updated log for focused guidance from experienced removers such as .

All 2 Replies

petercoti 1 Junior Poster in Training

20 Years Ago

i know u people must get tired of people like me, but i am no good with computers. please, could someone look at my hijack scan log

Logfile of HijackThis v1.99.1
Scan saved at 12:50:38 AM, on 10/20/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\perfcl.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\SPYWAR~2\swdoctor.exe
C:\PROGRA~1\WINZIP\wzqkpick.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Erikka\My Documents\Unzipped\hijackthis\HijackThis.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
R3 - URLSearchHook: (no name) - _{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\rrfoy.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
O3 - Toolbar: SearchToolbar - {08BEC6AA-49FC-4379-3587-4B21E286C19E} - C:\WINDOWS\System32\rrfoy.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PerformCl] C:\WINDOWS\System32\perfcl.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Search -
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: IEpal - CleanUp history, search and navigation - {75B4AE98-6967-4BFA-A254-3538918685AC} - C:\Program Files\IEpal\CIEpal.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: IEpal - Analyze page - {FA995425-8FB1-4692-A323-69A160117172} - C:\Program Files\IEpal\IEpal.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Microsoft AntiSpyware helper - {0D416680-8653-48A5-B37E-319FB2EA4F0B} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {0D416680-8653-48A5-B37E-319FB2EA4F0B} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {1B5A32D3-D89B-4BD2-9BEF-231F56056073} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {1B5A32D3-D89B-4BD2-9BEF-231F56056073} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {1DF48C15-ED01-41A6-A638-024C9BADC8F6} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {1DF48C15-ED01-41A6-A638-024C9BADC8F6} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {2769837E-1EC7-4309-8FF3-18BF5462537A} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {2769837E-1EC7-4309-8FF3-18BF5462537A} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {3DF2777B-583A-455B-95C6-DF1EDAD53FE3} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {3DF2777B-583A-455B-95C6-DF1EDAD53FE3} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {594A74BF-8BE4-4412-B536-1E624C717F6B} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {594A74BF-8BE4-4412-B536-1E624C717F6B} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {60BB2E04-7F6E-478A-8CF5-441AE74B1CFD} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {60BB2E04-7F6E-478A-8CF5-441AE74B1CFD} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {75C6640F-54B4-4CD4-96C7-FB4ECC264015} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {75C6640F-54B4-4CD4-96C7-FB4ECC264015} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {78003E54-581F-4EF2-B465-24F2FFF5715E} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {78003E54-581F-4EF2-B465-24F2FFF5715E} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {788623AD-E837-4916-BF36-E80BF6F90D80} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {788623AD-E837-4916-BF36-E80BF6F90D80} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {7A8B98D4-99BB-406B-810D-961B08183E69} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {7A8B98D4-99BB-406B-810D-961B08183E69} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {7E62E898-BFC9-4B75-9190-949D980A435C} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {7E62E898-BFC9-4B75-9190-949D980A435C} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {7EB119FD-ACAB-42E8-B944-3E062469338D} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {7EB119FD-ACAB-42E8-B944-3E062469338D} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {A142EDA5-59B1-4080-8499-0483F234F08B} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {A142EDA5-59B1-4080-8499-0483F234F08B} - (no file) (HKCU)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (file missing) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {E2294B2B-F86E-4129-9912-80A634BC8F6C} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {E2294B2B-F86E-4129-9912-80A634BC8F6C} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {E37D1681-D063-4A4E-8276-0B4CF8ABF67E} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {E37D1681-D063-4A4E-8276-0B4CF8ABF67E} - (no file) (HKCU)
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {10ABAAE7-6D4D-142E-D23E-6BE616628001} -
O16 - DPF: {11111111-1111-1111-1111-111191113457} - file://c:\ied_s7.cab
O16 - DPF: {11111111-1111-1111-1111-611111193457} - file://c:\wx.cab
O16 - DPF: {11111111-1111-1111-1111-611111193458} - file://c:\wx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BFF188D8-6633-4065-A931-33B129FC812B}: NameServer = ,
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O21 - SSODL: NTDBGTOOL - {C40C1FF6-CBDC-4871-AF57-E97F835D325C} - C:\WINDOWS\System32\c_28rpol.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Power Manager (PowerManager) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)
O23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINDOWS\System32\wdfmgr.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

What do you want to know.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

katanashi 0 Newbie Poster · Answer 1 · 2005-10-22T03:15:15+00:00

i cant get on to secure sites, what should i get rid of

Logfile of HijackThis v1.99.1
Scan saved at 5:13:41 PM, on 10/21/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\perfcl.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\SPYWAR~2\swdoctor.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Erikka\My Documents\Unzipped\hijackthis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R3 - URLSearchHook: (no name) - _{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PerformCl] C:\WINDOWS\System32\perfcl.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll
O9 - Extra button: IEpal - CleanUp history, search and navigation - {75B4AE98-6967-4BFA-A254-3538918685AC} - C:\Program Files\IEpal\CIEpal.exe (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: IEpal - Analyze page - {FA995425-8FB1-4692-A323-69A160117172} - C:\Program Files\IEpal\IEpal.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Microsoft AntiSpyware helper - {0D416680-8653-48A5-B37E-319FB2EA4F0B} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {0D416680-8653-48A5-B37E-319FB2EA4F0B} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {1B5A32D3-D89B-4BD2-9BEF-231F56056073} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {1B5A32D3-D89B-4BD2-9BEF-231F56056073} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {1DF48C15-ED01-41A6-A638-024C9BADC8F6} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {1DF48C15-ED01-41A6-A638-024C9BADC8F6} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {2769837E-1EC7-4309-8FF3-18BF5462537A} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {2769837E-1EC7-4309-8FF3-18BF5462537A} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {3DF2777B-583A-455B-95C6-DF1EDAD53FE3} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {3DF2777B-583A-455B-95C6-DF1EDAD53FE3} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {594A74BF-8BE4-4412-B536-1E624C717F6B} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {594A74BF-8BE4-4412-B536-1E624C717F6B} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {60BB2E04-7F6E-478A-8CF5-441AE74B1CFD} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {60BB2E04-7F6E-478A-8CF5-441AE74B1CFD} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {75C6640F-54B4-4CD4-96C7-FB4ECC264015} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {75C6640F-54B4-4CD4-96C7-FB4ECC264015} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {78003E54-581F-4EF2-B465-24F2FFF5715E} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {78003E54-581F-4EF2-B465-24F2FFF5715E} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {788623AD-E837-4916-BF36-E80BF6F90D80} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {788623AD-E837-4916-BF36-E80BF6F90D80} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {7A8B98D4-99BB-406B-810D-961B08183E69} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {7A8B98D4-99BB-406B-810D-961B08183E69} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {7E62E898-BFC9-4B75-9190-949D980A435C} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {7E62E898-BFC9-4B75-9190-949D980A435C} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {7EB119FD-ACAB-42E8-B944-3E062469338D} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {7EB119FD-ACAB-42E8-B944-3E062469338D} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {A142EDA5-59B1-4080-8499-0483F234F08B} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {A142EDA5-59B1-4080-8499-0483F234F08B} - (no file) (HKCU)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (file missing) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {E2294B2B-F86E-4129-9912-80A634BC8F6C} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {E2294B2B-F86E-4129-9912-80A634BC8F6C} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {E37D1681-D063-4A4E-8276-0B4CF8ABF67E} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {E37D1681-D063-4A4E-8276-0B4CF8ABF67E} - (no file) (HKCU)
O12 - Plugin for .avi: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O15 - Trusted Zone: www.amazon.com
O15 - Trusted Zone: http://www.ebay.com
O16 - DPF: {10ABAAE7-6D4D-142E-D23E-6BE616628001} -
O16 - DPF: {11111111-1111-1111-1111-111191113457} - file://c:\ied_s7.cab
O16 - DPF: {11111111-1111-1111-1111-611111193457} - file://c:\wx.cab
O16 - DPF: {11111111-1111-1111-1111-611111193458} - file://c:\wx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BFF188D8-6633-4065-A931-33B129FC812B}: NameServer = ,
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O21 - SSODL: NTDBGTOOL - {C40C1FF6-CBDC-4871-AF57-E97F835D325C} - C:\WINDOWS\System32\c_28rpol.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Power Manager (PowerManager) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)
O23 - Service: Windows User Mode Driver Framework (UMWdf) - Unknown owner - C:\WINDOWS\System32\wdfmgr.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

helpless amish guy/ HJT scan log

Dani AI

Recommended Answers Collapse Answers

All 2 Replies

Recommended Answers