Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

pokapoka79.exe removal?


  • Please log in to reply

#1
DaWolf879

DaWolf879

    New Member

  • Member
  • Pip
  • 3 posts
here is the hijack this&ewido log files




Logfile of HijackThis v1.99.1
Scan saved at 10:49:51 AM, on 8/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\LTMSG.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus10.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-qus10.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/home.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qus10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-qus10.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-qus10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://qus10.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - Startup: PowerReg Scheduler V3.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.h...staller_gmn.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcaf...01/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1155971791875
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1155971770453
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1....loadManager.ocx
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcaf...,26/mcgdmgr.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe



---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 10:38:44 AM 8/20/2006

+ Scan result:



C:\Program Files\Aprps -> Adware.Apropos : No action taken.
C:\Program Files\Aprps\AI_23-10-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\Aprps\AI_27-10-2005.log -> Adware.Apropos : No action taken.
C:\Program Files\NaviSearch -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\Uninstall.exe -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\bin -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\t1116176035.dec -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\t1119478427.dec -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\t1119826516.dec -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\t1124859795.dec -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\t1127514511.dec -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\t1127841922.dec -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\t1128127455.dec -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\t1128460619.dec -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\t1128461248.dec -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\t1128984146.dec -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\t1128990955.dec -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\t1129154005.dec -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\t1130713471.dec -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\t1130900127.dec -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\t1131314133.dec -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\t1132858566.dec -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\t1133221010.dec -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\t1133392671.dec -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\t1136230464.dec -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\t1137251041.dec -> Adware.BargainBuddy : No action taken.
C:\Program Files\NaviSearch\ub.dat -> Adware.BargainBuddy : No action taken.
C:\Program Files\Web Offer -> Adware.eZula : No action taken.
C:\Program Files\Web Offer\INSTALL.LOG -> Adware.eZula : No action taken.
C:\Program Files\Web Offer\UNWISE.EXE -> Adware.eZula : No action taken.
C:\Program Files\Web Offer\basisp.dst -> Adware.eZula : No action taken.
C:\Program Files\Web Offer\basisp.kwd -> Adware.eZula : No action taken.
C:\Program Files\Web Offer\basisp.pu -> Adware.eZula : No action taken.
C:\Program Files\Web Offer\basisp.rst -> Adware.eZula : No action taken.
C:\Program Files\Web Offer\gendis.ez -> Adware.eZula : No action taken.
C:\Program Files\Web Offer\paramp.ez -> Adware.eZula : No action taken.
C:\Program Files\Web Offer\rwdsp.rst -> Adware.eZula : No action taken.
C:\Program Files\Web Offer\upgradep.vrn -> Adware.eZula : No action taken.
C:\Program Files\Web Offer\versionp.vrn -> Adware.eZula : No action taken.
C:\Program Files\Web Offer\wndbannnp.src -> Adware.eZula : No action taken.
C:\Program Files\Internet Optimizer -> Adware.InternetOptimizer : No action taken.
C:\Program Files\Internet Optimizer\update -> Adware.InternetOptimizer : No action taken.
C:\Program Files\ISTbar -> Adware.ISTBar : No action taken.
C:\Program Files\ISTbar\imagemap_normal.bmp -> Adware.ISTBar : No action taken.
C:\Program Files\ISTbar\version.txt -> Adware.ISTBar : No action taken.
C:\Program Files\ISTsvc -> Adware.ISTBar : No action taken.
C:\Program Files\Media Access -> Adware.MediaAccess : No action taken.
C:\Program Files\Media Access\Info.txt -> Adware.MediaAccess : No action taken.
C:\Documents and Settings\Default User\Start Menu\Programs\Power Scan -> Adware.PowerScan : No action taken.
C:\Documents and Settings\Nicki\Start Menu\Programs\Power Scan -> Adware.PowerScan : No action taken.
C:\Documents and Settings\Owner\Start Menu\Programs\Power Scan -> Adware.PowerScan : No action taken.
C:\Program Files\Power Scan -> Adware.PowerScan : No action taken.
C:\Program Files\MaxSpeed -> Adware.SideFind : No action taken.
C:\Program Files\SEP -> Adware.SideFind : No action taken.
C:\Program Files\SideFind -> Adware.SideFind : No action taken.
C:\Program Files\SideFind\sfexd001 -> Adware.SideFind : No action taken.
C:\Program Files\SideFind\update -> Adware.SideFind : No action taken.
C:\WINDOWS\Temp\addit.exe -> Adware.WinFetcher : No action taken.
:mozilla.113:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.33:C:\Documents and Settings\Nicki\Application Data\Mozilla\Firefox\Profiles\jd4p6f6a.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.74:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.75:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.76:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.78:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.79:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.80:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.81:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.82:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
:mozilla.83:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Owner\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : No action taken.
:mozilla.84:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.85:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.86:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.Advertising : No action taken.
:mozilla.32:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.Atdmt : No action taken.
:mozilla.28:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.Com : No action taken.
:mozilla.64:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.65:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.Fastclick : No action taken.
:mozilla.111:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.112:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.87:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.Hitbox : No action taken.
:mozilla.51:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\sg13i7ru.default\cookies.txt -> TrackingCookie.Mediaplex : No action taken.
C:\Documents and Settings\Default User\Local Settings\Temp\131556_2964_2664_3988_79.41.tst -> Trojan.EliteBar.h : No action taken.
C:\Documents and Settings\Nicki\Local Settings\Temp\131556_2964_2664_3988_79.41.tst -> Trojan.EliteBar.h : No action taken.
C:\Documents and Settings\Owner\Local Settings\Temp\131556_2964_2664_3988_79.41.tst -> Trojan.EliteBar.h : No action taken.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temp\131556_2964_2664_3988_79.41.tst -> Trojan.EliteBar.h : No action taken.
C:\x.bat -> Trojan.Zapchast : No action taken.


::Report end
  • 0

Advertisements


#2
DaWolf879

DaWolf879

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
I also found this virus as well w/ewido trojan.zapchest located C:\x.bat


I just bought the comp from my neighbor 4 $200 us. It has a athlon xp 2.2 512 megs ram 80 gb hd dvd writer and speakers. Thought it was a good deal but it had a ton of virus&malware on it. I used mcafee suite 2 get rid of most of them but these last few are tough. Any help would be great.

Edited by DaWolf879, 19 August 2006 - 04:21 PM.

  • 0

#3
DaWolf879

DaWolf879

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
Is there any moderator's out there that can help me with my problem?
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP