Hijak This Log

phrack3r · February 17, 2007

ok i got hacked the other no idea how since i didnt download anything then next thing i kno i got hack changed pass and everything got hacked again so what should i delet with this HijakThis log thnx all.

Logfile of HijackThis v1.99.1

Scan saved at 1:40:48 PM, on 2/17/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss[Caution: ExecutableFile]

C:\WINDOWS\system32\winlogon[Caution: ExecutableFile]

C:\WINDOWS\system32\services[Caution: ExecutableFile]

C:\WINDOWS\system32\lsass[Caution: ExecutableFile]

C:\WINDOWS\system32\svchost[Caution: ExecutableFile]

C:\WINDOWS\System32\svchost[Caution: ExecutableFile]

C:\Program Files\Common Files\Symantec Shared\ccSetMgr[Caution: ExecutableFile]

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr[Caution: ExecutableFile]

C:\Program Files\CyberLink\PowerDVD\PDVDServ[Caution: ExecutableFile]

C:\Program Files\Common Files\Symantec Shared\ccApp[Caution: ExecutableFile]

C:\WINDOWS\zHotkey[Caution: ExecutableFile]

C:\Program Files\Digital Media Reader\shwiconem[Caution: ExecutableFile]

C:\WINDOWS\SOUNDMAN[Caution: ExecutableFile]

C:\WINDOWS\ALCWZRD[Caution: ExecutableFile]

C:\Program Files\HP\hpcoretech\hpcmpmgr[Caution: ExecutableFile]

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10[Caution: ExecutableFile]

C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2[Caution: ExecutableFile]

C:\Program Files\MessengerPlus! 3\MsgPlus[Caution: ExecutableFile]

C:\Program Files\Common Files\Real\Update_OB\realsched[Caution: ExecutableFile]

C:\Program Files\iTunes\iTunesHelper[Caution: ExecutableFile]

C:\Program Files\Java\jre1.5.0_10\bin\jusched[Caution: ExecutableFile]

C:\Program Files\Internet Explorer\iexplore[Caution: ExecutableFile]

C:\Program Files\BigFix\BigFix[Caution: ExecutableFile]

c:\progra~1\intern~1\iexplore[Caution: ExecutableFile]

C:\Program Files\Lavasoft\Personal Firewall\lpfw[Caution: ExecutableFile]

C:\Program Files\Norton AntiVirus\navapsvc[Caution: ExecutableFile]

C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC[Caution: ExecutableFile]

C:\Program Files\iPod\bin\iPodService[Caution: ExecutableFile]

C:\WINDOWS\system32\wscntfy[Caution: ExecutableFile]

C:\Program Files\Norton AntiVirus\SAVScan[Caution: ExecutableFile]

C:\WINDOWS\system32\spoolsv[Caution: ExecutableFile]

C:\WINDOWS\system32\svchost[Caution: ExecutableFile]

C:\WINDOWS\system32\wuauclt[Caution: ExecutableFile]

C:\Program Files\Mozilla Firefox\firefox[Caution: ExecutableFile]

C:\Program Files\WinRAR\WinRAR[Caution: ExecutableFile]

C:\WINDOWS\explorer[Caution: ExecutableFile]

C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile]

C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX06.984\HijackThis[Caution: ExecutableFile]

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O2 - BHO: (no name) - {7D258670-C8F6-11B7-4BAE-6A0AACF7FD67} - C:\DOCUME~1\Owner\APPLIC~1\EGGSRO~1\knob platform[Caution: ExecutableFile] (file missing)

O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut[Caution: ExecutableFile]

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ[Caution: ExecutableFile]"

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp[Caution: ExecutableFile]"

O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz[Caution: ExecutableFile] /GUID NAV /CMDLINE "REBOOT"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck[Caution: ExecutableFile]

O4 - HKLM\..\Run: [CHotkey] zHotkey[Caution: ExecutableFile]

O4 - HKLM\..\Run: [showWnd] ShowWnd[Caution: ExecutableFile]

O4 - HKLM\..\Run: [sunKistEM] C:\Program Files\Digital Media Reader\shwiconem[Caution: ExecutableFile]

O4 - HKLM\..\Run: [soundMan] SOUNDMAN[Caution: ExecutableFile]

O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD[Caution: ExecutableFile]

O4 - HKLM\..\Run: [Alcmtr] ALCMTR[Caution: ExecutableFile]

O4 - HKLM\..\Run: [symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon[Caution: ExecutableFile] /Consumer

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr[Caution: ExecutableFile]"

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10[Caution: ExecutableFile]

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2[Caution: ExecutableFile]"

O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus[Caution: ExecutableFile]"

O4 - HKLM\..\Run: [Open Warn Face Part] C:\Documents and Settings\All Users\Application Data\DEBUGBROWSEOPENWARN\mp3drv[Caution: ExecutableFile]

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched[Caution: ExecutableFile]" -osboot

O4 - HKLM\..\Run: [Personal Firewall] C:\Program Files\Lavasoft\Personal Firewall\lpfw[Caution: ExecutableFile] /waitservice

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask[Caution: ExecutableFile]" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper[Caution: ExecutableFile]"

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_10\bin\jusched[Caution: ExecutableFile]

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr[Caution: ExecutableFile]" /background

O4 - HKCU\..\Run: [balm Play] C:\DOCUME~1\Owner\APPLIC~1\GLOBAL~1\longforkintra[Caution: ExecutableFile]

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype[Caution: ExecutableFile]" /nosplash /minimized

O4 - HKCU\..\Run: [steam] "c:\program files\valve\steam\steam[Caution: ExecutableFile]" -silent

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader[Caution: ExecutableFile]

O4 - Startup: HotSync Manager.lnk = C:\Program Files\palmOne\HOTSYNC[Caution: ExecutableFile]

O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix[Caution: ExecutableFile]

O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim[Caution: ExecutableFile]

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile]

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile]

O14 - IERESET.INF: START_PAGE_URL=http://www.gateway.com

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: C:\PROGRA~1\Lavasoft\PERSON~1\wl_hook.dll

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc[Caution: ExecutableFile]

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr[Caution: ExecutableFile]

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc[Caution: ExecutableFile]

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr[Caution: ExecutableFile]

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT[Caution: ExecutableFile]

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService[Caution: ExecutableFile]

O23 - Service: Lavasoft Personal Firewall Service (LavasoftFirewall) - Agnitum Ltd. - C:\Program Files\Lavasoft\Personal Firewall\lpfw[Caution: ExecutableFile]

O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc[Caution: ExecutableFile]

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd[Caution: ExecutableFile]" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan[Caution: ExecutableFile]

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ[Caution: ExecutableFile]

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc[Caution: ExecutableFile]

O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC[Caution: ExecutableFile]

coltm4carbine · February 17, 2007

===

Step 1

====

Move HiJackthis out of the temp. Preferably to it's own folder, somewhere on the desktop.

====

Step 2

====

Download NoLop to your desktop from one of the links below...

]Link 1

Link 2

Link 3

[*:3n1bsp95]First close any other programs you have running as this will require a reboot

[*:3n1bsp95]Double click NoLop[Caution: ExecutableFile] to run it
- [*:3n1bsp95]Carefully type or copy and paste this series of characters into the lower text area labelled Insert CLSID Here. Include the {}:
  
  {7D258670-C8F6-11B7-4BAE-6A0AACF7FD67}

[*:3n1bsp95]Now click the button labelled "Search and Destroy"

<>

[*:3n1bsp95] When scanning is finished you will be prompted to reboot only if infected, Click OK

[*:3n1bsp95] Now click the "REBOOT" Button.

[*:3n1bsp95] A Message should popup from NoLop. If not, double click the program again and it will finish Please Post the contents of C:\NoLop.log along with a fresh HijackThis log

--If you receive an error, "mscomctl.ocx or one of its dependencies are not correctly registered," please download mscomctl.ocx to your system32 folder then rerun the program. --

=====

Step 3

=====

Post a new HJT log and the nolop log.

Edit...woops typo...

phrack3r · February 17, 2007

ok thnx and here we starting with NoLop log....

Fix running from: C:\Documents and Settings\Owner\Desktop

[2/17/2007]

[4]

---Infection Files Found/Removed---

C:\Documents and Settings\Owner\Application Data\Global multi\longforkintra[Caution: ExecutableFile]

C:\Documents and Settings\All Users\Application Data\DEBUGBROWSEOPENWARN\mp3drv[Caution: ExecutableFile]

C:\WINDOWS\tasks\B9BC601F832C16D7.job

HJT Log:

Logfile of HijackThis v1.99.1

Scan saved at 4:20:46 PM, on 2/17/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss[Caution: ExecutableFile]

C:\WINDOWS\system32\winlogon[Caution: ExecutableFile]

C:\WINDOWS\system32\services[Caution: ExecutableFile]

C:\WINDOWS\system32\lsass[Caution: ExecutableFile]

C:\WINDOWS\system32\svchost[Caution: ExecutableFile]

C:\WINDOWS\System32\svchost[Caution: ExecutableFile]

C:\WINDOWS\system32\ZoneLabs\vsmon[Caution: ExecutableFile]

C:\WINDOWS\Explorer[Caution: ExecutableFile]

C:\Program Files\Common Files\Symantec Shared\ccSetMgr[Caution: ExecutableFile]

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr[Caution: ExecutableFile]

C:\WINDOWS\system32\spoolsv[Caution: ExecutableFile]

C:\Program Files\Lavasoft\Personal Firewall\lpfw[Caution: ExecutableFile]

C:\Program Files\Norton AntiVirus\navapsvc[Caution: ExecutableFile]

C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC[Caution: ExecutableFile]

C:\Program Files\Norton AntiVirus\SAVScan[Caution: ExecutableFile]

C:\WINDOWS\system32\wscntfy[Caution: ExecutableFile]

C:\Program Files\CyberLink\PowerDVD\PDVDServ[Caution: ExecutableFile]

C:\Program Files\Common Files\Symantec Shared\ccApp[Caution: ExecutableFile]

C:\WINDOWS\zHotkey[Caution: ExecutableFile]

C:\Program Files\Digital Media Reader\shwiconem[Caution: ExecutableFile]

C:\WINDOWS\SOUNDMAN[Caution: ExecutableFile]

C:\WINDOWS\ALCWZRD[Caution: ExecutableFile]

C:\Program Files\HP\hpcoretech\hpcmpmgr[Caution: ExecutableFile]

C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10[Caution: ExecutableFile]

C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2[Caution: ExecutableFile]

C:\Program Files\Common Files\Real\Update_OB\realsched[Caution: ExecutableFile]

C:\Program Files\Internet Explorer\iexplore[Caution: ExecutableFile]

C:\Program Files\iTunes\iTunesHelper[Caution: ExecutableFile]

C:\Program Files\Java\jre1.5.0_10\bin\jusched[Caution: ExecutableFile]

C:\Program Files\Zone Labs\ZoneAlarm\zlclient[Caution: ExecutableFile]

C:\Program Files\iPod\bin\iPodService[Caution: ExecutableFile]

c:\progra~1\intern~1\iexplore[Caution: ExecutableFile]

C:\Program Files\BigFix\BigFix[Caution: ExecutableFile]

C:\WINDOWS\system32\wuauclt[Caution: ExecutableFile]

C:\Program Files\Mozilla Firefox\firefox[Caution: ExecutableFile]

C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile]

C:\Documents and Settings\Owner\Desktop\pjs stuff\HijackThis[Caution: ExecutableFile]