Member Avatar for hatespy

Logfile of HijackThis v1.99.1
Scan saved at 8:46:29, on 1/12/2549
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM\ATIPTAXX.EXE
C:\WINDOWS\SYSTEM\ATI2CWXX.EXE
C:\WINDOWS\SYSTEM\TOSMEM.EXE
C:\WINDOWS\SYSTEM\HPZTSB03.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\JI-SPEED UP WEB ACCELERATOR\JINETCORE.EXE
C:\PROGRAM FILES\SCANSOFT\OMNIPAGESE2.0\OPWARESE2.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\DISTILLR\ACROTRAY.EXE
C:\PROGRAM FILES\JI-SPEED UP WEB ACCELERATOR\JINETGUI.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\HIJACKTHIS.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\ACROBAT\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\ACROBAT\ACROIEFAVCLIENT.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: NOW!Imaging - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - C:\PROGRAM FILES\JI-SPEED UP WEB ACCELERATOR\COMPONENTS\NOWIMAGING.DLL
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\ACROBAT\ACROIEFAVCLIENT.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Ji-Speed Up Web Accelerator - {8B79EE88-E62D-4AA8-B530-CC357BA112B7} - C:\PROGRAM FILES\JI-SPEED UP WEB ACCELERATOR\TOOLBAND.DLL
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ATIPOLAB] ati2evxx.exe
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [Ati2cwxx] Ati2cwxx.exe
O4 - HKLM\..\Run: [TosMem] tosmem.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb03.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\Ji-Speed Up Web Accelerator\jinetcore.exe"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [Zone Labs Client] "C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZLCLIENT.EXE"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Startup: Ji-Speed Up Web Accelerator.lnk = C:\Program Files\Ji-Speed Up Web Accelerator\jinetgui.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE

  • 5 Contributors
  • 5 Replies
  • 209 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by kylethedarkn

Dani AI

Generated

Good call by to target the "webHancer Survey Companion" entry — that entry is the most obvious PUP in the log — but remove it carefully. HijackThis’s "Fix checked" only removes registry references; it does not delete program files and can disable services if the wrong item is removed. Make a full backup (export the registry or create a restore point), save a fresh HijackThis log, then fix only that single O4 entry and reboot to test. (bleepingcomputer.com)

WebHancer (whSurvey/whAgent) is commonly classified as adware that inserts itself into the Winsock/LSP chain; naive deletion can break Internet access. Recommended sequence: uninstall WebHancer from Add/Remove Programs if it appears; run an up‑to‑date anti‑adware scanner (Spybot/Ad‑aware or an equivalent modern tool) to remove residual files; if connectivity is lost, repair the Winsock/LSP chain with a tool such as LSP‑Fix. If LSP‑Fix lists webhdll.dll or similar, remove only the offending LSP entries and follow the tool’s guidance. (myantispyware.com)

About the log date: "1/12/2549" is using the Thai/Buddhist calendar (BE = CE + 543), so 2549 BE = 2006 CE — the scan was saved on December 1, 2006. Double‑check system locale/time settings after cleanup; incorrect time/locale can make TLS/updates behave oddly and will confuse diagnostics. (calendarz.com)

A few extra items tied to the thread: post a complete fresh HijackThis log (full output) as suggested so helpers see entries omitted earlier. If you don’t recognize the "Ji‑Speed Up Web Accelerator" items, uninstall or remove them the same way (Add/Remove Programs + anti‑adware scan). Finally, is right to flag the OS: Windows Me reached end of support in mid‑2006 and receives no security updates, so long‑term safety requires moving off WinME to a supported system. (microsoft.com)

If you want, supply a new HJT log after the steps above (or report whether Internet failed after uninstall); that will let responders confirm the remaining cleanup steps.

Recommended Answers

All 5 Replies

Member Avatar for Chaky

Check "O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe" in your hijackthis and click on "fix checked" button.

Member Avatar for gurutech

I would also check the date on your system. Seems to be a little off. :-)

Member Avatar for Chaky

Scan saved at 8:46:29, on 1/12/2549

Looks more like a stardate from star treck.

Member Avatar for gerbil

er... that would be a buddhist date... such as from thailand, laos.... but still a bit of a westernised corruption for simplicity, less confusion, cos their new year day would be our april 13. i think. And that was only half a log; a lot of important entries are missing. You should post the whole log from a fresh scan.

Member Avatar for kylethedarkn

Also I personally would update from Windows Me because the internet and Windows ME don't really mix well.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.