HiJack This 2.0 Log - Help Needed Please! New Log Up

daver · November 21, 2007

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 9:48:07 PM, on 11/20/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss[Caution: Executable File]

C:\WINDOWS\system32\csrss[Caution: Executable File]

C:\WINDOWS\system32\winlogon[Caution: Executable File]

C:\WINDOWS\system32\services[Caution: Executable File]

C:\WINDOWS\system32\lsass[Caution: Executable File]

C:\WINDOWS\system32\svchost[Caution: Executable File]

C:\WINDOWS\System32\svchost[Caution: Executable File]

C:\WINDOWS\system32\svchost[Caution: Executable File]

C:\Program Files\Common Files\Symantec Shared\ccSetMgr[Caution: Executable File]

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr[Caution: Executable File]

C:\WINDOWS\system32\spoolsv[Caution: Executable File]

C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon[Caution: Executable File]

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc[Caution: Executable File]

C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd[Caution: Executable File]

C:\Program Files\Norton AntiVirus\navapsvc[Caution: Executable File]

C:\Program Files\Norton AntiVirus\IWP\NPFMntor[Caution: Executable File]

C:\WINDOWS\system32\svchost[Caution: Executable File]

C:\WINDOWS\system32\wdfmgr[Caution: Executable File]

C:\WINDOWS\System32\alg[Caution: Executable File]

C:\Program Files\Synaptics\SynTP\SynTPLpr[Caution: Executable File]

C:\WINDOWS\SOUNDMAN[Caution: Executable File]

C:\Program Files\HP\HP Software Update\HPWuSchd2[Caution: Executable File]

C:\Program Files\Java\jre1.6.0_03\bin\jusched[Caution: Executable File]

C:\WINDOWS\system32\regsvr32[Caution: Executable File]

C:\Program Files\MyWebSearch\bar\b.bin\m3IMPipe[Caution: Executable File]

C:\PROGRA~1\SSTEM~1\iexplore[Caution: Executable File]

C:\Documents and Settings\Elaina\Application Data\Microsoft\Windows\kwtjx[Caution: Executable File]

C:\Program Files\Viewpoint\Common\ViewpointService[Caution: Executable File]

C:\Program Files\Mozilla Firefox\firefox[Caution: Executable File]

C:\Program Files\Spybot - Search & Destroy\TeaTimer[Caution: Executable File]

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice[Caution: Executable File]

C:\WINDOWS\Explorer[Caution: Executable File]

C:\Documents and Settings\Elaina\Desktop\HiJackThis_v2[Caution: Executable File]

C:\WINDOWS\system32\wbem\wmiprvse[Caution: Executable File]

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://my.netzero.net/s/sp?r=al&cf=sp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.net/s/search?r=minisearch

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.netzero.net/s/search?r=minisearch

F2 - REG:system.ini: Shell=Explorer[Caution: Executable File] C:\WINDOWS\shell[Caution: Executable File]

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {2F02D978-0FF6-80F7-60BB-0426224AB7B3} - C:\Program Files\xwbioaou\yaxyoiob.dll

O2 - BHO: (no name) - {47828D9D-3409-398F-2173-4DB67A3AF2C9} - C:\WINDOWS\system32\ark.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O2 - BHO: (no name) - {E091D951-63C2-394E-BD5F-4F76661A0D94} - C:\WINDOWS\system32\aok.dll (file missing)

O2 - BHO: (no name) - {E1A3D930-35F9-6C7D-DE2C-48E600F45B95} - C:\WINDOWS\system32\clu.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD[Caution: Executable File]

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck[Caution: Executable File]

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray[Caution: Executable File]

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd[Caution: Executable File]

O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut[Caution: Executable File]

O4 - HKLM\..\Run: [sMSERIAL] sm56hlpr[Caution: Executable File]

O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr[Caution: Executable File]

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh[Caution: Executable File]

O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD[Caution: Executable File]

O4 - HKLM\..\Run: [Alcmtr] ALCMTR[Caution: Executable File]

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp[Caution: Executable File]"

O4 - HKLM\..\Run: [New Value #1] c:\sysprep\test\ftest\ftest[Caution: Executable File]

O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG[Caution: Executable File]

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2[Caution: Executable File]

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask[Caution: Executable File]" -atboottime

O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1153704658\ee\AOLSoftware[Caution: Executable File]

O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay[Caution: Executable File] SYSTEMBOOTHIDEPLAYER

O4 - HKLM\..\Run: [iPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend[Caution: Executable File]

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched[Caution: Executable File]"

O4 - HKLM\..\Run: [AOLT4] D:\AOLSETUP[Caution: Executable File] -ACS

O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\b.bin\MWSBAR.DLL,S

O4 - HKLM\..\Run: [ftduqhu] c:\windows\system32\ftduqhu[Caution: Executable File] ftduqhu

O4 - HKLM\..\Run: [horycy] C:\Program Files\Windows NT\horycy77798[Caution: Executable File]

O4 - HKLM\..\Run: [Printer] C:\WINDOWS\system32\printer[Caution: Executable File]

O4 - HKLM\..\Run: [xgbefmhq] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\xgbefmhq.dll"

O4 - HKLM\..\Run: [qfknclyz] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\qfknclyz.dll"

O4 - HKLM\..\Run: [cxwjupuv] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\cxwjupuv.dll"

O4 - HKLM\..\Run: [cbwdwvun] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\cbwdwvun.dll"

O4 - HKLM\..\Run: [lilshgro] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\lilshgro.dll"

O4 - HKLM\..\Run: [cnwhmdix] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\cnwhmdix.dll"

O4 - HKLM\..\Run: [rozetiha] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\rozetiha.dll"

O4 - HKLM\..\Run: [wxixgfob] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\wxixgfob.dll"

O4 - HKLM\..\Run: [vupkfyho] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\vupkfyho.dll"

O4 - HKLM\..\Run: [szovsrqh] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\szovsrqh.dll"

O4 - HKLM\..\Run: [fohmvila] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\fohmvila.dll"

O4 - HKLM\..\Run: [firojwvw] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\firojwvw.dll"

O4 - HKLM\..\Run: [junevite] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\junevite.dll"

O4 - HKLM\..\Run: [nehwronu] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\nehwronu.dll"

O4 - HKLM\..\Run: [rklylepe] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\rklylepe.dll"

O4 - HKLM\..\Run: [hodyzkly] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\hodyzkly.dll"

O4 - HKLM\..\Run: [fktotsjs] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\fktotsjs.dll"

O4 - HKLM\..\Run: [tidsfere] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\tidsfere.dll"

O4 - HKLM\..\Run: [lszileno] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\lszileno.dll"

O4 - HKLM\..\Run: [olizadgr] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\olizadgr.dll"

O4 - HKLM\..\Run: [chwlifyn] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\chwlifyn.dll"

O4 - HKLM\..\Run: [fabkhafi] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\fabkhafi.dll"

O4 - HKLM\..\Run: [ehcjulov] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\ehcjulov.dll"

O4 - HKLM\..\Run: [azszwpep] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\azszwpep.dll"

O4 - HKLM\..\Run: [opgdutop] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\opgdutop.dll"

O4 - HKLM\..\Run: [tolmlcpe] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\tolmlcpe.dll"

O4 - HKLM\..\Run: [ozyxabir] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\ozyxabir.dll"

O4 - HKLM\..\Run: [zipctklq] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\zipctklq.dll"

O4 - HKLM\..\RunOnce: [spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD[Caution: Executable File]" /autocheck

O4 - HKLM\..\RunOnce: [spybotDeletingA9046] command /c del "C:\Program Files\Instant Access\Center\tray1.ico"

O4 - HKLM\..\RunOnce: [spybotDeletingC8771] cmd /c del "C:\Program Files\Instant Access\Center\tray1.ico"

O4 - HKLM\..\RunOnce: [spybotDeletingA7843] command /c del "C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll"

O4 - HKLM\..\RunOnce: [spybotDeletingC7361] cmd /c del "C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll"

O4 - HKLM\..\RunOnce: [spybotDeletingA4508] command /c del "C:\Program Files\Internet Explorer\msimg32.dll"

O4 - HKLM\..\RunOnce: [spybotDeletingC4256] cmd /c del "C:\Program Files\Internet Explorer\msimg32.dll"

O4 - HKLM\..\RunOnce: [spybotDeletingA9663] command /c del "C:\WINDOWS\system32\drivers\core.cache.dsk"

O4 - HKLM\..\RunOnce: [spybotDeletingC9242] cmd /c del "C:\WINDOWS\system32\drivers\core.cache.dsk"

O4 - HKLM\..\RunOnce: [spybotDeletingA3390] command /c del "C:\WINDOWS\system32\drivers\core.sys"

O4 - HKLM\..\RunOnce: [spybotDeletingC9813] cmd /c del "C:\WINDOWS\system32\drivers\core.sys"

O4 - HKLM\..\RunOnce: [spybotDeletingA882] command /c del "C:\Program Files\AVSystemCare\Addons\popupg.dll_old"

O4 - HKLM\..\RunOnce: [spybotDeletingC5410] cmd /c del "C:\Program Files\AVSystemCare\Addons\popupg.dll_old"

O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr[Caution: Executable File]

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs[Caution: Executable File]" /background

O4 - HKCU\..\Run: [My Web Search Community Tools] "C:\Program Files\MyWebSearch\bar\b.bin\m3IMPipe[Caution: Executable File]"

O4 - HKCU\..\Run: [Aud] "C:\PROGRA~1\SSTEM~1\iexplore[Caution: Executable File]" -vt yazb

O4 - HKCU\..\Run: [Fjbicak] C:\WINDOWS\s?stem\??rvices[Caution: Executable File]

O4 - HKCU\..\Run: [skbsf] "C:\Documents and Settings\Elaina\Application Data\??crosoft\n?lookup[Caution: Executable File]"

O4 - HKCU\..\Run: [omof] C:\PROGRA~1\COMMON~1\omof\omofm[Caution: Executable File]

O4 - HKCU\..\Run: [spoolsv] C:\WINDOWS\system32\spoolvs[Caution: Executable File]

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer[Caution: Executable File]

O4 - HKCU\..\Run: [sfKg6w] C:\Documents and Settings\Elaina\Application Data\Microsoft\Windows\kwtjx[Caution: Executable File]

O4 - HKCU\..\Run: [WinTouch] C:\Documents and Settings\Elaina\Application Data\WinTouch\WinTouch[Caution: Executable File]

O4 - Startup: findfast[Caution: Executable File]

O4 - Startup: IMVU.lnk = C:\Program Files\IMVU\IMVUClient[Caution: Executable File]

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl[Caution: Executable File]

O4 - Global Startup: autorun[Caution: Executable File]

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08[Caution: Executable File]

O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate[Caution: Executable File]

O8 - Extra context menu item: &Search - ?p=ZJfox000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Greg\Start Menu\Programs\IMVU\Run IMVU.lnk

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: Executable File]

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: Executable File]

O14 - IERESET.INF: START_PAGE_URL=http://my.netzero.net/s/sp?r=al&cf=sp

O16 - DPF: {04F414E9-E352-4BC3-963D-7BFE5A5F31A9} - http://scripts.dlv4.com/binaries/egacce ... 064_XP.cab

O16 - DPF: {0878F049-D33E-45E0-A157-C36A6683CF25} - http://scripts.dlv4.com/binaries/egacce ... 063_XP.cab

O16 - DPF: {5F4D3335-3194-4167-85AE-E7325F2695EF} - http://scripts.dlv4.com/binaries/egacce ... _em_XP.cab

O16 - DPF: {AA59202C-5E41-48FC-AF7D-324F5FD6A9F1} - http://scripts.dlv4.com/binaries/egacce ... _em_XP.cab

O16 - DPF: {CB5D474E-A510-40A4-B5A4-838933BCBA64} - http://scripts.dlv4.com/binaries/egacce ... 065_XP.cab

O16 - DPF: {FA1D6D8F-C6ED-4752-8512-A33283240130} - http://es6-scripts.dlv4.com/binaries/eg ... 066_XP.cab

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice[Caution: Executable File]

O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon[Caution: Executable File]

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc[Caution: Executable File]

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr[Caution: Executable File]

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT[Caution: Executable File]

O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService[Caution: Executable File]

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1[Caution: Executable File]

O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc[Caution: Executable File]

O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor[Caution: Executable File]

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12[Caution: Executable File]

O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan[Caution: Executable File]

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ[Caution: Executable File]

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc[Caution: Executable File]

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc[Caution: Executable File]

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService[Caution: Executable File]

O24 - Desktop Component 0: (no name) - C:\Program Files\MSN Gaming Zone\profsy.html

--

End of file - 15358 bytes

blade995 · November 21, 2007

First of all, you don't need to post a new thread, use the same one. Second of all you didn't do what I asked, you need to scan for spyware and viruses BEFORE you post a log, I know you didn't, so don't say otherwise.

If you remove the entries from here without removing the rest with ad-aware and spybot you will have problems. If you actually want to fix a computer, that is what you have to do.

daver · November 21, 2007

Ok I will try to do that. After I have done that I will let you know, and then you can help?

blade995 · November 21, 2007

Ok I will try to do that. After I have done that I will let you know, and then you can help?

Of course, the reason I saying all of this is not to be a **** but to help you. It would be a waste of everybody's time to look at a log like that.

Make sure the definitions are updates on the scanners before using them.

daver · November 21, 2007

I ran spybot. It found 631 problems (glad not my computer) um it said it fixed all except 15. But I am going to run ad aware. Then post a new hijack this log for ya.

daver · November 21, 2007

Ran ADaware foud over 1,000 infections. GOING to post a new log!! :)

Work that magic pls ty! HOPEFULLY WILL FIX some things.

Kill_Life · November 21, 2007

Locking since you have 2 topics which are the same.

~Kill Life

Sign In

HiJack This 2.0 Log - Help Needed Please! New Log Up

Recommended Posts

daver

Link to comment

Share on other sites

blade995

Link to comment

Share on other sites

daver

Link to comment

Share on other sites

blade995

Link to comment

Share on other sites

daver

Link to comment

Share on other sites

daver

Link to comment

Share on other sites

Kill_Life

Link to comment

Share on other sites

Browse

Activity

Important Information