Can someone please check my HJT Log?

fakeeoghan · November 6, 2005

Well here it is:

Logfile of HijackThis v1.99.1

Scan saved at 19:00:27, on 06/11/2005

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINNT\System32\smss[Caution: ExecutableFile]

C:\WINNT\system32\winlogon[Caution: ExecutableFile]

C:\WINNT\system32\services[Caution: ExecutableFile]

C:\WINNT\system32\lsass[Caution: ExecutableFile]

C:\WINNT\system32\ibmpmsvc[Caution: ExecutableFile]

C:\WINNT\system32\svchost[Caution: ExecutableFile]

C:\WINNT\System32\svchost[Caution: ExecutableFile]

C:\WINNT\system32\spoolsv[Caution: ExecutableFile]

C:\WINNT\system32\Ati2evxx[Caution: ExecutableFile]

C:\Program Files\AVPersonal\AVWUPSRV[Caution: ExecutableFile]

C:\WINNT\system32\CTsvcCDA[Caution: ExecutableFile]

c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr[Caution: ExecutableFile]

C:\WINNT\Explorer[Caution: ExecutableFile]

C:\WINNT\System32\NTME\METHWNT[Caution: ExecutableFile]

C:\WINNT\System32\NTME\brad32[Caution: ExecutableFile]

C:\Program Files\Kodak\Kodak EasyShare software\bin\ptssvc[Caution: ExecutableFile]

C:\WINNT\System32\QCONSVC[Caution: ExecutableFile]

C:\WINNT\system32\MSTask[Caution: ExecutableFile]

C:\WINNT\system32\ScsiAccess[Caution: ExecutableFile]

C:\WINNT\System32\WBEM\WinMgmt[Caution: ExecutableFile]

C:\WINNT\System32\mspmspsv[Caution: ExecutableFile]

C:\WINNT\system32\svchost[Caution: ExecutableFile]

C:\WINNT\system32\tp4serv[Caution: ExecutableFile]

C:\WINNT\system32\atiptaxx[Caution: ExecutableFile]

C:\WINNT\LTSMMSG[Caution: ExecutableFile]

C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR[Caution: ExecutableFile]

C:\WINNT\system32\PRPCUI[Caution: ExecutableFile]

C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY[Caution: ExecutableFile]

C:\Program Files\AVPersonal\AVSched32[Caution: ExecutableFile]

C:\Program Files\Common Files\Real\Update_OB\realsched[Caution: ExecutableFile]

C:\WINNT\AGRSMMSG[Caution: ExecutableFile]

C:\Program Files\Media Access\MediaAccK[Caution: ExecutableFile]

C:\Program Files\Java\jre1.5.0_04\bin\jusched[Caution: ExecutableFile]

C:\Program Files\Media Access\MediaAccess[Caution: ExecutableFile]

C:\PROGRA~1\Sony\SONICS~1\SsAAD[Caution: ExecutableFile]

C:\Program Files\Libgrb\Xwsi[Caution: ExecutableFile]

C:\Program Files\iTunes\iTunesHelper[Caution: ExecutableFile]

C:\Program Files\QuickTime\qttask[Caution: ExecutableFile]

C:\WINNT\ConnectionStatus\Microsoft\services[Caution: ExecutableFile]

C:\Program Files\winupdates\winupdates[Caution: ExecutableFile]

C:\WINNT\system32\internat[Caution: ExecutableFile]

C:\Program Files\Creative\MediaSource\Detector\CTDetect[Caution: ExecutableFile]

C:\Program Files\Spyware Doctor\swdoctor[Caution: ExecutableFile]

C:\Program Files\MSN Messenger\msnmsgr[Caution: ExecutableFile]

C:\Program Files\iPod\bin\iPodService[Caution: ExecutableFile]

C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV[Caution: ExecutableFile]

C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR[Caution: ExecutableFile]

C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex[Caution: ExecutableFile]

C:\Program Files\AVPersonal\AVGNT[Caution: ExecutableFile]

C:\Program Files\Mozilla Firefox\firefox[Caution: ExecutableFile]

C:\Program Files\WinRAR\WinRAR[Caution: ExecutableFile]

C:\Documents and Settings\Admin\Desktop\Hijack\HijackThis[Caution: ExecutableFile]

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,(Default) = http://66.250.171.137/dpindex.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\about.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=proxy.aon.at:8080;http=proxy.aon.at:8080

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.aon.at;*.jet2web.net;

R3 - URLSearchHook: (no name) - _{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)

F2 - REG:system.ini: UserInit=C:\WINNT\system32\Userinit[Caution: ExecutableFile]

O1 - Hosts: 66.250.171.167 sitefinder.verisign.com

O1 - Hosts: 66.250.171.167 sitefinder-idn.verisign.com

O1 - Hosts: 66.250.57.9 view.atdmt.com

O1 - Hosts: 66.250.57.9 click.atdmt.com

O1 - Hosts: 66.250.57.9 leader.linkexchange.com

O1 - Hosts: 66.250.57.9 pagead2.googlesyndication.com

O2 - BHO: DLMaxObj Class - {00000000-59D4-4008-9058-080011001200} - C:\WINNT\dlmax.dll (file missing)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: iMeshBar BHO - {5345A7A1-805A-4923-B505-86B2FEBA3FE0} - C:\Program Files\iMeshBar\bar\1.bin\IMESHBAR.DLL (file missing)

O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll

O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll

O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: SE-Toolbar - {691AFBC1-3C46-406D-AD22-EB3A0F665FC1} - C:\WINNT\system32\setoolbar.dll

O3 - Toolbar: iMeshBar - {5345A7A9-805A-4923-B505-86B2FEBA3FE0} - C:\Program Files\iMeshBar\bar\1.bin\IMESHBAR.DLL (file missing)

O4 - HKLM\..\Run: [TrackPointSrv] tp4serv[Caution: ExecutableFile]

O4 - HKLM\..\Run: [AtiPTA] atiptaxx[Caution: ExecutableFile]

O4 - HKLM\..\Run: [LTSMMSG] LTSMMSG[Caution: ExecutableFile]

O4 - HKLM\..\Run: [synchronization Manager] mobsync[Caution: ExecutableFile] /logon

O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR[Caution: ExecutableFile]

O4 - HKLM\..\Run: [TP4EX] tp4ex[Caution: ExecutableFile]

O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI[Caution: ExecutableFile]

O4 - HKLM\..\Run: [TPTRAY] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY[Caution: ExecutableFile]

O4 - HKLM\..\Run: [ConfigSafe] C:\CFGSAFE\NTFSCLUP[Caution: ExecutableFile]

O4 - HKLM\..\Run: [CSScheduleCheck] C:\CFGSAFE\SCHWIZEX[Caution: ExecutableFile] -CHECK

O4 - HKLM\..\Run: [AVSCHED32] C:\Program Files\AVPersonal\AVSched32[Caution: ExecutableFile] /min

O4 - HKLM\..\Run: [sbar] "C:\WINNT\regit[Caution: ExecutableFile]" C:\WINNT

O4 - HKLM\..\Run: [sountskmanager] sountaskmgr

O4 - HKLM\..\Run: [AspConfig] C:\WINNT\AspConfig[Caution: ExecutableFile]

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched[Caution: ExecutableFile]" -osboot

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG[Caution: ExecutableFile]

O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO[Caution: ExecutableFile]

O4 - HKLM\..\Run: [paywxengtj] C:\WINNT\system32\hzemdl[Caution: ExecutableFile]

O4 - HKLM\..\Run: [fweradggs] C:\WINNT\system32\fweradggs[Caution: ExecutableFile]

O4 - HKLM\..\Run: [ntTJm] C:\WINNT\mwuxpcd[Caution: ExecutableFile]

O4 - HKLM\..\Run: [iHP-100] C:\Program Files\iRiver\iHP100\iHPDetect[Caution: ExecutableFile]

O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK[Caution: ExecutableFile]

O4 - HKLM\..\Run: [wrstip] C:\WINNT\wrstip[Caution: ExecutableFile]

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched[Caution: ExecutableFile]

O4 - HKLM\..\Run: [ntTJmÃÆÃâÃâÃÂº*ÃÆÃâÃâÃÂ¡aÃÆÃâÃâÃÂ®ÃÆÃ¢â¬Â¦ÃâÃÂ¾rgÃÆÃâÃâÃ

coltm4carbine · November 6, 2005

ok forget what i said. plan b now.

Have you been clicking links in emails? it looks like you have. In other words I am concerned that you might have the sober.p virus and a few other trojans...

Please run full scans with Ad-Aware SE and Spybot-S&D as follows:

(If you already have Ad-Aware SE 1.06 and Spybot 1.4 installed, you can skip the installation steps. If you don't, please uninstall your old versions and install the new ones from the links below.)

Full Ad-Aware Scan

Please download Ad-Aware SE from here:

http://www.majorgeeks.com/download506.html

Install Ad-Aware and run it. In the bottom-right hand corner, click "Check for updates now". Click "Connect" to download the newest reference file.

Now we will configure Ad-Aware to perform a full scan. In the Ad-Aware main window, click on the gear icon at the top of the screen to open the preferences window. In the "General" window, make sure the following options are selected:

1) Automatically save log-file

2) Automatically quarantine objects prior to removal

3) Safe Mode (always request confirmation)

Click the "Scanning" button on the left-hand side and make sure the following options are selected:

1) Scan within archives

2) Scan active processes

3) Scan registry

4) Deep scan registry

4) Scan my IE Favorites for banned URLs

5) Scan my Hosts file

Please also click on "Select drives & folders to scan" and select your hard drive(s). Then click the "Advanced" button on the left-hand side and make sure all the options under "Log-file Detail Level" are selected. Next, click the "Tweak" button on the left-hand side. Click on "Scanning Engine" and make sure the following options are selected:

1) Unload recognized processes & modules during scanning

2) Obtain command line of scanned processes

3) Scan registry for all users instead of current user only

Click on "Cleaning Engine" and make sure the following options are selected:

1) Always try to unload modules before deletion

2) During removal, unload Explorer and IE if necessary

3) Let Windows remove files in use at next reboot

4) Delete quarantined objects after restoring

Finally, click on "Safety Settings" and make sure the following options are selected:

1) Automatically select problematic objects in results lists

2) Write-protect system files after repair (Hosts file, etc)

Click on "Proceed" to save the preferences. Then please click the "Start" button on the bottom right side to begin a scan. Select "Use custom scanning options" and then click "Next". Ad-Aware will then scan for malware. When it is finished, make sure any objects listed in RED are selected and click "Next" to remove the objects. Then please restart your computer.

Spybot Full Scan

Next, please download Spybot-S&D from here:

http://www.majorgeeks.com/download.php?det=2471

Install Spybot-S&D and run it. Select "Search for updates" and then select all available updates. Click on the drop-down box in the top center to choose a download location nearest to you. Then click "Download updates". When all updates have downloaded, close Spybot-S&D, and then run it again. Click on "Check for problems". When the scan has finished, select any entries listed in red and click "Fix selected problems". Then please restart your computer again.

Then try this online virus scan:

Trend- Micro

Choose "fix" or "clean".

Let it remove any infections found.

Reboot and "copy/paste" a new Hijack This! log file into this thread.

fakeeoghan · November 6, 2005

Wow, thanks for all that help. I do have Adaware and Spybot but I aslo share a computer with my sister :? .

I'm running adaware now although I couldn't find this part anywhere:

Finally, click on "Safety Settings" and make sure the following options are selected:

1) Automatically select problematic objects in results lists

2) Write-protect system files after repair (Hosts file, etc)

I also have an antivirus called AntiVir. When I try to open this I get a message saying something like "No viruses, trojans or spyware were found!".

This also happened when I tried to run HJT. Has me kinda worried...

coltm4carbine · November 6, 2005

yeh not supprised at all.

I can see at least a trojan

1 sober.p varient (might be the "o")

a new virus that has just came out a few days ago. (doesn't have a name yet)

I decided not to continue analyzing it until you have ran the scans because it is soo bad.

Quote:

Finally, click on "Safety Settings" and make sure the following options are selected:

1) Automatically select problematic objects in results lists

2) Write-protect system files after repair (Hosts file, etc)

ok don't worry about that.

can you also run these online scans ontop of that one.

Please run the Housecall online virus scan located at:

http://housecall.trendmicro.com/houseca ... t_corp.asp

Follow the prompts to scan your hard drive for viruses. Select the "Autoclean" option so that Housecall will remove any viruses from your system.

When the scan is finished, please restart your computer.

Then please run the Panda scan here:

http://www.pandasoftware.com/products/a ... ncipal.htm

Choose to "Disinfect automatically," and follow the prompts. Delete any viruses found, and restart your computer.

Finally, please run the WindowSecurity trojan scan here:

http://www.windowsecurity.com/trojanscan/

Remove any trojans found, and restart your computer.

These should get rid of most of the bad entries.

If you cannot run HJT v1.99.1 you might want to try these (again it's taken from my canned speech so it might sound wrong):-

Here are a couple of steps to try and run HijackThis. Follow them in order. If one step doesn't work, continue to the next step:

Step # 1

Rename HijackThis[Caution: ExecutableFile] to H[Caution: ExecutableFile]. Try a scan. If it works, post the log back here. If not, proceed to the next step.

Step # 2

Go to this link and download the 1.98.2 version of HijackThis[Caution: ExecutableFile]:

hijackthis1.98.2

Try a scan. If it works, post the log back here. If not, proceed to the next step.

Step # 3

Click here and download Itty Bitty Process Manager (IBProcMan.zip): ibprocman.

Unzip it to it's own directory and try running it - it will provide a 'taskmanager' like process viewer in which you can stop running processes.

Don't stop any yet, just list all that it has so whe can check them and give advice. Post the list back here.

btw is your desktop looking normal (you know like has it got anything odd)?

fakeeoghan · November 6, 2005

I will do all of those scans. My desktop looks ok but I have not been able to open the task manager and the computer has been kind of slow for the last day or two.

fakeeoghan · November 6, 2005

Thanks alot coltm4carbine, your canned speech was just fine although the panda link did not work. I'm running the windowsecurity trojan scan atm and have already run adaware, spybot and the trend micro one. After running all of these (except the Trojan scan one) windows task manager would still not open. The trend micro one found some things that it "could not access". Maybe thats the problem?

Anyway I'll finish up the scan that's running right now then post a new HJT log and we will see.

Thanks again. This advice has been very useful and I do appreciate you taking your time to put it together.

fakeeoghan · November 7, 2005

After doing this scan; http://www.windowsecurity.com/trojanscan/ I am left with a list of files on my computer. Are these files after being deleted or is this scan just telling me what is wrong with my computer. there is red link under the list of files saying "To clean your computer and stay protected, click here to download a-squared Personal now!"

Do I have to click this for it to delete the viruses it found and if so, is it free??

fakeeoghan · November 7, 2005

I think the trojan is gone. Task manager is opening fine as well as my antivirus and HJT. Here is the new HJT Log:

Logfile of HijackThis v1.99.1

Scan saved at 02:56:16, on 07/11/2005

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINNT\System32\smss[Caution: ExecutableFile]

C:\WINNT\system32\winlogon[Caution: ExecutableFile]

C:\WINNT\system32\services[Caution: ExecutableFile]

C:\WINNT\system32\lsass[Caution: ExecutableFile]

C:\WINNT\system32\ibmpmsvc[Caution: ExecutableFile]

C:\WINNT\system32\svchost[Caution: ExecutableFile]

C:\WINNT\System32\svchost[Caution: ExecutableFile]

C:\WINNT\system32\spoolsv[Caution: ExecutableFile]

C:\WINNT\system32\Ati2evxx[Caution: ExecutableFile]

C:\WINNT\system32\CTsvcCDA[Caution: ExecutableFile]

c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr[Caution: ExecutableFile]

C:\WINNT\System32\NTME\METHWNT[Caution: ExecutableFile]

C:\WINNT\System32\NTME\brad32[Caution: ExecutableFile]

C:\Program Files\Kodak\Kodak EasyShare software\bin\ptssvc[Caution: ExecutableFile]

C:\WINNT\System32\QCONSVC[Caution: ExecutableFile]

C:\WINNT\system32\MSTask[Caution: ExecutableFile]

C:\WINNT\system32\ScsiAccess[Caution: ExecutableFile]

C:\WINNT\System32\WBEM\WinMgmt[Caution: ExecutableFile]

C:\WINNT\System32\mspmspsv[Caution: ExecutableFile]

C:\WINNT\system32\svchost[Caution: ExecutableFile]

C:\WINNT\Explorer[Caution: ExecutableFile]

C:\WINNT\system32\tp4serv[Caution: ExecutableFile]

C:\WINNT\system32\atiptaxx[Caution: ExecutableFile]

C:\WINNT\LTSMMSG[Caution: ExecutableFile]

C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR[Caution: ExecutableFile]

C:\WINNT\system32\PRPCUI[Caution: ExecutableFile]

C:\PROGRA~1\ThinkPad\UTILIT~1\TP98TRAY[Caution: ExecutableFile]

C:\Program Files\Common Files\Real\Update_OB\realsched[Caution: ExecutableFile]

C:\WINNT\AGRSMMSG[Caution: ExecutableFile]

C:\Program Files\Media Access\MediaAccess[Caution: ExecutableFile]

C:\Program Files\Java\jre1.5.0_04\bin\jusched[Caution: ExecutableFile]

C:\PROGRA~1\Sony\SONICS~1\SsAAD[Caution: ExecutableFile]

C:\Program Files\iTunes\iTunesHelper[Caution: ExecutableFile]

C:\Program Files\QuickTime\qttask[Caution: ExecutableFile]

C:\WINNT\system32\internat[Caution: ExecutableFile]

C:\Program Files\Creative\MediaSource\Detector\CTDetect[Caution: ExecutableFile]

C:\Program Files\Spyware Doctor\swdoctor[Caution: ExecutableFile]

C:\Program Files\MSN Messenger\msnmsgr[Caution: ExecutableFile]

C:\Program Files\iPod\bin\iPodService[Caution: ExecutableFile]

C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV[Caution: ExecutableFile]

C:\Program Files\a-squared\a2guard[Caution: ExecutableFile]

C:\Program Files\Media Access\MediaAccK[Caution: ExecutableFile]

C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR[Caution: ExecutableFile]

C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex[Caution: ExecutableFile]

C:\Program Files\AVPersonal\AVWUPSRV[Caution: ExecutableFile]

C:\Program Files\AVPersonal\AVSched32[Caution: ExecutableFile]

C:\Program Files\Mozilla Firefox\firefox[Caution: ExecutableFile]

C:\Documents and Settings\Admin\Desktop\Hijack\HijackThis[Caution: ExecutableFile]

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ie/