Member Avatar for Ozzmark

I was wondering if anyone can point out any viruses or key loggers on my computer.I use symantec corporate addition.

Here is my Hijackthis log


Logfile of HijackThis v1.99.1
Scan saved at 2:17:20 PM, on 16/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
G:\WINDOWS\Explorer.EXE
G:\WINDOWS\system32\spoolsv.exe
G:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
G:\Program Files\Common Files\Symantec Shared\ccApp.exe
G:\PROGRA~1\SYMANT~1\VPTray.exe
G:\WINDOWS\system32\RunDLL32.exe
G:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
G:\Program Files\Symantec AntiVirus\DefWatch.exe
G:\WINDOWS\system32\nvsvc32.exe
G:\Program Files\Symantec AntiVirus\Rtvscan.exe
G:\WINDOWS\system32\wscntfy.exe
G:\Program Files\Xfire\Xfire.exe
G:\Program Files\Ventrilo\Ventrilo.exe
G:\Program Files\Mozilla Firefox\firefox.exe
G:\WINDOWS\System32\svchost.exe
G:\Program Files\MSN Messenger\msnmsgr.exe
G:\Documents and Settings\Mark\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE G:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "G:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] G:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [HostManager] G:\Program Files\Common Files\AOL\1153179304\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [IPHSend] G:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKLM\..\Run: [ccApp] "G:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] G:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] G:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickFinder Scheduler] "G:\Program Files\WordPerfect Office X3\Programs\QFSCHD130.EXE"
O4 - HKLM\..\Run: [ISUSPM Startup] "G:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "G:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [Steam] "g:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [4ddd44b5.exe] G:\Documents and Settings\Mark\Local Settings\Application Data\4ddd44b5.exe
O8 - Extra context menu item: Open with WordPerfect - G:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) -
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://drivecleaner.com/.freeware/installdrivecleanerstart.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {97B79133-88F0-45F0-8D57-0F2EF27D9C66} -
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "G:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - G:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - G:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - G:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVRoam (SavRoam) - symantec - G:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - G:\Program Files\Symantec AntiVirus\Rtvscan.exe

  • 2 Contributors
  • 1 Reply
  • 130 Views
  • 15 Hours Discussion Span
  • Latest Post Latest Post by Xpenetrator

Dani AI

Generated

The HijackThis scan and ’s analysis point to the classic downloader/adware pattern: unexpected startup entries paired with ActiveX/DPF components pulled from obscure hosts. Those indicators often mean additional payloads were dropped and that signature-only protection can miss parts of the chain. Treat the system as potentially compromised until verified clean.

Immediate containment and evidence preservation: isolate the PC from the network and image the drive if possible. Copy personal documents to external media (avoid copying executables). If account credentials might be exposed, change them only from a known-clean device. Save the HijackThis log and any other logs before making removals.

A safe, practical workflow for diagnosis and cleanup:

  • Boot to Safe Mode or use a trusted rescue environment to avoid malware self-protection.
  • Use a process/handle inspector to examine suspicious processes’ parent tree, path, and digital signature.
  • Use an autorun/startup inspector (Autoruns) to disable unfamiliar startup entries, then “jump to” the file location to inspect the binary before deletion.
  • Submit unknown binaries to multi-engine scanners or check their signatures; run reputable on-demand scanners (antimalware and rootkit scanners) from Safe Mode or rescue media.
  • If a rootkit or persistent kernel component is suspected, scan with offline rescue media and consider a full reimage if removal isn’t certain.

Cautions and final notes: back up the registry before manual edits and avoid blind deletion of system files. When sensitive accounts were used on the machine, assume compromise and prefer restore/reinstall from known-clean media. This expands on ’s flags and provides a containment-to-remediation path for ’s reported findings.

Member Avatar for Xpenetrator

Your log has these fishy entries:

O4 - HKCU\..\Run: [4ddd44b5.exe] G:\Documents and Settings\Mark\Local Settings\Application Data\4ddd44b5.exe
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - hxxp://drivecleaner.com/.freeware/in...eanerstart.cab

I found a description here:

(Win32/Beenut Family - looks you clicked "ok" on a fraudulent message window?)

O16 - DPF: {97B79133-88F0-45F0-8D57-0F2EF27D9C66} - hxxp://
Is a dialer (?) which probably came as additional payload of the malware above. It refers to an IP address from the same hoster in the Ukraine. I'm not sure if this is only a dialer.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.