Member Avatar for mela7877

Logfile of HijackThis v1.99.1
Scan saved at 10:10:14 AM, on 3/12/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\explorer.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\regedit.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Mom\Local Settings\Temporary Internet Files\Content.IE5\O3Y1E5G3\hijackthis[1]\HijackThis.exe

F2 - REG:system.ini: Shell=explorer.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AdwareAlert] C:\Program Files\AdwareAlert\AdwareAlert.Exe -boot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: Desert Dollar - {2C0C09B8-AF12-45ad-9C01-C22B6A5A40A1} - C:\Program Files\desertdollar\casinogame.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) -
O16 - DPF: {360E40AA-EE8B-4101-BA67-0CAD3F7A48DD} (Nyoko Downloader Class) - http://www.luckynugget.com/download_helper/Nyoko.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) -
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

  • 3 Contributors
  • 8 Replies
  • 266 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by D3m3nt3d

Dani AI

Generated

A short, practical triage and cleanup plan based on the thread: the HijackThis scans posted by show several third‑party downloaders/toolbars and no active antivirus; correctly advised running HJT from its own folder, and pointed out the lack of protection and patching. Because a backdoor lets an outsider control the machine, reduce exposure first and follow a conservative removal workflow.

Recommended immediate steps:

  1. Isolate the PC — unplug Ethernet and disable Wi‑Fi (physical disconnect). This prevents remote control or credential theft while troubleshooting.
  2. Boot outside msconfig — use the F8 boot menu to enter Safe Mode (or Safe Mode with Networking if a download is needed). msconfig closing immediately can be a sign malware is blocking admin tools; F8 bypasses that.
  3. From Safe Mode run a dedicated HJT copy (in its own folder) and save the logfile. Do not blindly click Fix Checked without matching entries to trusted cleanup advice.
  4. Run multiple, up‑to‑date on‑demand scanners (for example an anti‑malware and an antivirus), and run a rootkit/boot‑sector scanner or a rescue CD if Windows cannot be trusted. Use a process‑stopping utility before scans if malware prevents removal.
  5. Back up personal files to external media and scan those backups before restoring; if persistent suspicious services/processes remain, plan a full OS reinstall from known‑good media.

After cleanup: remove old restore points, install current security software and updates on a clean system, and change all passwords from a different, uncompromised machine. If administrative tools remain blocked or a persistent backdoor is detected, a complete reinstall of the OS is the safest recovery.

Recommended Answers

All 8 Replies

Member Avatar for tayspen

Hi, and welcome; This line shows that you did not not extract HJT to its own folder, you just ran it. For best results HJT needs to be run form its own folder.


C:\Documents and Settings\Mom\Local Settings\Temporary Internet Files\Content.IE5\O3Y1E5G3\hijackthis[1]\HijackThis.exe

Do that and post a new log. :).

Member Avatar for mela7877

I hope this I did it right this time. Pls help!

Logfile of HijackThis v1.99.1
Scan saved at 3:42:09 PM, on 3/12/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Yahoo!\YPSR\ypsr.exe
C:\Hijack\HijackThis.exe

F2 - REG:system.ini: Shell=explorer.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O9 - Extra button: Desert Dollar - {2C0C09B8-AF12-45ad-9C01-C22B6A5A40A1} - C:\Program Files\desertdollar\casinogame.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) -
O16 - DPF: {360E40AA-EE8B-4101-BA67-0CAD3F7A48DD} (Nyoko Downloader Class) - http://www.luckynugget.com/download_helper/Nyoko.cab
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

Member Avatar for tayspen

Yes you did :).

Now scan again with HJT, and out a check next to the following items.


O9 - Extra button: Desert Dollar - {2C0C09B8-AF12-45ad-9C01-C22B6A5A40A1} - C:\Program Files\desertdollar\casinogame.exe

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O16 - DPF: {360E40AA-EE8B-4101-BA67-0CAD3F7A48DD} (Nyoko Downloader Class) - http://www.luckynugget.com/download_helper/Nyoko.cab

Then click Fix Checked. One entry up there, has to do with online poker/casinos. If you do gamble online, then dont remove this one, as it is most likley legit.


O9 - Extra button: Desert Dollar - {2C0C09B8-AF12-45ad-9C01-C22B6A5A40A1} - C:\Program Files\desertdollar\casinogame.exe

Scan gain and post a new log.

Member Avatar for D3m3nt3d

Are you running this log from Safe Mode?

You show no running processes, no Antivirus, and you are on a completely unpatched version of Windows!

If this log isnt in Safe Mode, you are a complete vulnerability right now....

Member Avatar for mela7877

Are you running this log from Safe Mode?

You show no running processes, no Antivirus, and you are on a completely unpatched version of Windows!

If this log isnt in Safe Mode, you are a complete vulnerability right now....

I'm not in safemode. I tried but whenever I went into msconfig it just starts running for a second and the window disappears. and I don't really know how to use hijack

Member Avatar for mela7877

I'm not in safe mode because when I tried running msconfig it would start running for about a second and then the window would just disappear. And I don't really know how to use hijack this. What should I do?

Member Avatar for mela7877

I tried this but that backdoor creature is still there. Here's the results.

Logfile of HijackThis v1.99.1
Scan saved at 8:22:16 PM, on 3/13/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Hijack\HijackThis.exe

F2 - REG:system.ini: Shell=explorer.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) -
O16 - DPF: {360E40AA-EE8B-4101-BA67-0CAD3F7A48DD} (Nyoko Downloader Class) - http://www.luckynugget.com/download_helper/Nyoko.cab
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) -
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) -
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

Member Avatar for D3m3nt3d

What is detecting this for you to say its an AIM bot?

Also - log still looks like it is in Safe Mode, if it isnt, then there is nothing on this computer at all!

No downloaded programs, no Antivirus, Firewall etc.

All you have to do is restart the computer, and let it start naturally, dont use MSConfig to try and start it.

Then Open HijackThis
-Choose Scan and save a Logfile
-Attach the notepad for me

Download Spysweeper here
http://www.malwareteks.com/dload.php?action=download&file_id=5
-Update to the latest definitions and run it
-Please attach the log when you return along with a new HijackThis log

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.