Member Avatar for SteveBrincat

Logfile of HijackThis v1.97.7
Scan saved at 1:17:17 PM, on 7/8/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\gsicon.exe
C:\Program Files\Lucent\Adsl\dslagent.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\SpeedUp\speeditup.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\BitTornado\btdownloadgui.exe
C:\Program Files\BitTornado\btdownloadgui.exe
C:\Program Files\BitTornado\btdownloadgui.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Steve Brincat\My Documents\My Received Files\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext =
F2 - REG:system.ini: UserInit=C:\Windows\System32\wsaupdater.exe,
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll
O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\Downloaded Program Files\bridge.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Outpost Firewall] C:\PROGRA~1\Agnitum\OUTPOS~1\outpost.exe /waitservice
O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\Lucent\Adsl\dslagent.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\Downloaded Program Files\bridge.dll",Load
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [SpeedItUp] c:\SpeedUp\speeditup.exe -MINI
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O9 - Extra button: Trashcan (HKCU)
O9 - Extra 'Tools' menuitem: Show Trashcan (HKCU)
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) -
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) -
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} (brdg Class) -
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) -
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{215EC05E-8B52-4399-B275-20EC06EA927C}: NameServer =

  • 3 Contributors
  • 2 Replies
  • 190 Views
  • 11 Hours Discussion Span
  • Latest Post Latest Post by Powder

Dani AI

Generated

Brief summary and practical workflow that follows the thread: OP posted a HijackThis log indicating extra toolbars and modified startup entries; correctly recommended running anti‑spyware and reminded that HJT is a diagnostic tool; pointed to an older how‑to. The entries in that log show the two usual patterns for a persistent taskbar search box: a toolbar/BHO installed into Explorer/IE, and a startup/run entry or registry change that reinstalls it at boot. The steps below remove the visible toolbar, then hunt the installer and repair system settings safely.

Practical, safe workflow (do these in order)

  1. Create a System Restore point and export the registry (run regedit, File → Export → All).
  2. Reboot to Safe Mode (F8) and run updated anti‑spyware + antivirus scanners (the suggestions from @alc6379 are a good start).
  3. Remove visible toolbars: Control Panel → Add/Remove Programs (uninstall suspicious toolbars), then right‑click the taskbar → Toolbars and uncheck unknown toolbars.
  4. Check startup items with msconfig and the Run keys (HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run) and disable unknown entries.
  5. Create a fresh HijackThis log (save it). Use HJT to identify suspect entries but avoid using “Fix” blindly; HJT is best for generating a log for targeted removal.
  6. Scan again in normal mode; if the bar returns at boot, proceed to manual registry/hosts/DNS checks below.

Manual checks and cautions

  • Only after backing up the registry: inspect HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit and the Browser Helper Objects/Toolbar keys under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer. Incorrect edits here can break logon or IE.
  • Typical Winlogon Userinit should point to userinit.exe; if altered, restore it exactly and reboot. Example (backup first):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit = C:\WINDOWS\system32\userinit.exe,

Prevention and closing notes
Also check the Hosts file and the TCP/IP DNS settings for unexpected entries, keep OS and browser patched, and avoid bundled toolbars during installs. This approach expands on ’s anti‑spyware advice and follows the caution about using HJT only as a diagnostic step; for any uncertain registry or GUID removals, rely on an experienced removal guide or a trusted malware‑removal forum rather than guessing.

Recommended Answers

All 2 Replies

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.