Help. someone stealing my HD place over net!, really dunno what's wrong! |
Discover the best free computer help!
Learn more about Geeks to Go by taking the tour. Spyware, virus, trojan, fake security or privacy alerts? Read the malware cleaning guide.
Learn more about Geeks to Go by taking the tour. Spyware, virus, trojan, fake security or privacy alerts? Read the malware cleaning guide.
  |
 Dec 16 2005, 10:58 AM
Post
#1
|
|
|
New Member  Posts: 1 OS: xp  |
Anybody help, or at least hint me what maybe the cause!!! I did even a hijackthis scan and it goes like this: Logfile of HijackThis v1.99.1 Scan saved at 17:45:46, on 16.12.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\SYSTEM32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\Explorer.EXE D:\WINDOWS\system32\spoolsv.exe D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe D:\Program Files\Winamp\winampa.exe D:\Program Files\Common Files\Symantec Shared\ccApp.exe D:\Program Files\QuickTime\qttask.exe D:\temp\salm.exe D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe D:\WINDOWS\SOUNDMAN.EXE D:\WINDOWS\system32\ctfmon.exe D:\WINDOWS\System32\drivers\CDAC11BA.EXE D:\Program Files\Common Files\Symantec Shared\ccProxy.exe D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE D:\WINDOWS\system32\slserv.exe D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe D:\WINDOWS\System32\svchost.exe D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe D:\Program Files\Mozilla Firefox\firefox.exe C:\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.24ur.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://D:\DOCUME~1\halfdane\LOCALS~1\Temp\sp.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://D:\DOCUME~1\halfdane\LOCALS~1\Temp\sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://D:\DOCUME~1\halfdane\LOCALS~1\Temp\sp.html R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://D:\DOCUME~1\halfdane\LOCALS~1\Temp\sp.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank F3 - REG:win.ini: run=D:\WINDOWS\inetdata\services.exe O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - D:\WINDOWS\localNRD.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {1D7E3B41-23CE-469B-BE1B-A64B877923E1} - D:\PROGRA~1\SEARCH~2\SEARCH~1.DLL O2 - BHO: HBO Class - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - D:\WINDOWS\inetdata\1.00.06.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - D:\WINDOWS\2_0_1browserhelper2.dll (file missing) O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - D:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: (no name) - {D069D455-0231-47EC-A6E0-3E801A07950C} - D:\WINDOWS\System32\hdil.dll (file missing) O3 - Toolbar: (no name) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - (no file) O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - D:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [PPMemCheck] D:\PROGRA~1\STOMPS~1\SPYWAR~1\PPMemCheck.exe O4 - HKLM\..\Run: [Spyware X-terminator Control Center] D:\PROGRA~1\STOMPS~1\SPYWAR~1\PPControl.exe O4 - HKLM\..\Run: [CookiePatrol] D:\PROGRA~1\STOMPS~1\SPYWAR~1\CookiePatrol.exe O4 - HKLM\..\Run: [Windows Firewalll] srhost.exe O4 - HKLM\..\Run: [Microsoft IT Update] winn43.exe O4 - HKLM\..\Run: [Microsoft Update Machine] rxxhost.exe O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [Sygate Personal Firewall] syserror.exe O4 - HKLM\..\Run: [ccApp] "D:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Symantec NetDriver Monitor] D:\PROGRA~1\SYMNET~1\SNDMon.exe O4 - HKLM\..\Run: [Windows DLL Loader] D:\WINDOWS\system32\defragfatx.exe O4 - HKLM\..\Run: [Windows Shell Value] wsv32.exe O4 - HKLM\..\Run: [.mscdsr] D:\WINDOWS\system\lsvchost.exe O4 - HKLM\..\Run: [FSWebServer] D:\Program Files\Easy File Sharing Web Server\fsws.exe O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Corel Graphics Suite 1117] D:\Program Files\Corel\Corel Graphics 11\Register\registration.exe /title="Corel Graphics Suite 11" /date=052605 serial=DR11CTD-9999999-KHM O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] D:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=122405 serial=DR12WEX-1504397-KTY lang=EN O4 - HKLM\..\Run: [salm] d:\temp\salm.exe O4 - HKLM\..\Run: [Internet Optimizer] "D:\Program Files\Internet Optimizer\optimize.exe" O4 - HKLM\..\Run: [lkdwvoh] D:\WINDOWS\lkdwvoh.exe O4 - HKLM\..\Run: [KASP] "D:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Spam Personal\OESpamTest.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [KAVPersonal50] "D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize O4 - HKLM\..\RunServices: [Windows Firewalll] srhost.exe O4 - HKLM\..\RunServices: [Microsoft IT Update] winn43.exe O4 - HKLM\..\RunServices: [Microsoft Update Machine] rxxhost.exe O4 - HKLM\..\RunServices: [Sygate Personal Firewall] syserror.exe O4 - HKLM\..\RunServices: [Sysino] lsess.exe O4 - HKLM\..\RunServices: [Winamp media player] winapa.exe O4 - HKLM\..\RunServices: [NDIS Adapter] svchosttt.exe O4 - HKLM\..\RunServices: [Windows media service] crsss.exe O4 - HKLM\..\RunServices: [Windows Shell Value] wsv32.exe O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Spyware Begone] C:\freescan\freescan.exe -FastScan O4 - HKCU\..\Run: [Windows Firewalll] srhost.exe O4 - HKCU\..\Run: [Microsoft IT Update] winn43.exe O4 - HKCU\..\Run: [Microsoft Update Machine] rxxhost.exe O4 - HKCU\..\Run: [AllTracksGone] D:\Program Files\AllTracksGone\alltracksgone.exe O4 - HKCU\..\Run: [Sysino] lsess.exe O4 - HKCU\..\Run: [Sygate Personal Firewall] syserror.exe O4 - HKCU\..\Run: [Winamp media player] winapa.exe O4 - HKCU\..\Run: [NDIS Adapter] svchosttt.exe O4 - HKCU\..\Run: [NBJ] "D:\Program Files\Ahead\Nero BackItUp\NBJ.exe" O4 - HKCU\..\Run: [Symantec NetDriver Monitor] D:\PROGRA~1\SYMNET~1\SNDMon.exe O4 - Startup: Reboot.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: I&zvoz v Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O15 - Trusted Zone: www.mt-download.com O15 - Trusted Zone: install.xxxtoolbar.com O15 - Trusted Zone: www.mt-download.com (HKLM) O15 - Trusted Zone: install.xxxtoolbar.com (HKLM) O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\ied_s7.cab O16 - DPF: {11111111-1111-1111-1111-511111113457} - file://c:\x.cab O16 - DPF: {11111111-1111-1111-1111-511111113458} - file://c:\x.cab O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.35mb.com/applet/applet_l.cab O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAcc...Bridge-c139.cab O16 - DPF: {23232323-2323-2323-2323-232323231122} - file://c:\x.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1108601028578 O17 - HKLM\System\CCS\Services\Tcpip\..\{6A9CC9A8-92A5-4E55-AB4C-50A0E65B767F}: NameServer = 212.18.32.10 212.18.32.12 O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - D:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Filter: text/html - {66CABEB3-714E-4DAE-BDD6-AB31DE2929D7} - D:\WINDOWS\System32\hdil.dll O18 - Filter: text/plain - {66CABEB3-714E-4DAE-BDD6-AB31DE2929D7} - D:\WINDOWS\System32\hdil.dll O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe O23 - Service: C-DillaCdaC11BA - Macrovision - D:\WINDOWS\System32\drivers\CDAC11BA.EXE O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: kavsvc - Kaspersky Lab - D:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe O23 - Service: Macromedia Licensing Service - Unknown owner - D:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - D:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing) O23 - Service: SmartLinkService (SLService) - - D:\WINDOWS\SYSTEM32\slserv.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe |
 |
 
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
Similar Topics
| Topic Title | Replies / Views | Topic Information | |||||
|---|---|---|---|---|---|---|---|
 |
3 / 322 | 6th August 2005 - 01:22 PM actraveler started - last by Keith |
|||||
 |
15 / 457 | 10th January 2007 - 06:07 AM cros4t started - last by acklan |
|||||
|
0 / 215 | 10th January 2008 - 11:30 AM BrianR1976 started - last by BrianR1976 |
|||||
|
8 / 432 | 8th June 2008 - 10:40 PM commie started - last by commie |
|||||
|
Time is now: 1st December 2008 - 06:30 PM |
| Advertisements do not imply our endorsement of that product or service. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. |
