Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works

security iguard popping up

  • This topic is locked This topic is locked



    New Member

  • Member
  • Pip
  • 1 posts
i've got a warning from norton antivirus that i downloaded trojan.download, later backdoor.nibu. Since then I've got internet explorer starting up and popping up every five minutes going to a page security iguard or spyikiller. I've run Ad-aware,
CWshredder, spybot, spywareblaster and did a norton virusscan. It didn't solve the problem.
This is my hijackfile:
Logfile of HijackThis v1.99.1
Scan saved at 20:43:42, on 15-4-2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O1 - Hosts: <html>
O1 - Hosts: <head>
O1 - Hosts: <meta http-equiv="Content-Language" content="en-us">
O1 - Hosts: <title>P2dll.com install toolbar</title>
O1 - Hosts: <meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
O1 - Hosts: <link href="style.css" rel="stylesheet" type="text/css">
O1 - Hosts: </head>
O1 - Hosts: <body bgcolor="#FFFFFF" background="images/layout_55.gif" leftmargin="0" topmargin="0" marginwidth="0" marginheight="0">
O1 - Hosts: <!-- ImageReady Slices (layout.psd) -->
O1 - Hosts: <table id="Table_01" width="100" height="651" border="0" cellpadding="0" cellspacing="0">
O1 - Hosts: <!-- MSTableType="nolayout" -->
O1 - Hosts: <tr>
O1 - Hosts: <td colspan="11">
O1 - Hosts: <img src="images/layout_01.gif" width="470" height="104" alt=""></td>
O1 - Hosts: <td colspan="5">
O1 - Hosts: <img src="images/layout_02.gif" width="302" height="104" alt=""></td>
O1 - Hosts: <td width="100" rowspan="8" background="images/layout_03.gif">
O1 - Hosts: <img src="images/layout_03.gif" width="8" height="294" alt=""></td>
O1 - Hosts: <td>
O1 - Hosts: <img src="images/spacer.gif" width="1" height="104" alt=""></td>
O1 - Hosts: </tr>
O1 - Hosts: <tr>
O1 - Hosts: <td>
O1 - Hosts: <img src="images/layout_04.gif" width="16" height="42" alt=""></td>
O1 - Hosts: <td>
O1 - Hosts: <A href=/><img src="images/layout_05.gif" width="81" height="42" alt="" border=0></A></td>
O1 - Hosts: <td>
O1 - Hosts: <img src="images/layout_06.gif" width="18" height="42" alt=""></td>
O1 - Hosts: <td colspan="2">
O1 - Hosts: <A href=index?name=about><img src="images/layout_07.gif" width="72" height="42" alt="" border=0></A></td>
O1 - Hosts: <td>
O1 - Hosts: <img src="images/layout_08.gif" width="18" height="42" alt=""></td>
O1 - Hosts: <td>
O1 - Hosts: <A href=write><img src="images/layout_09.gif" width="83" height="42" alt="" border=0></A></td>
O1 - Hosts: <td>
O1 - Hosts: <img src="images/layout_10.gif" width="20" height="42" alt=""></td>
O1 - Hosts: <td>
O1 - Hosts: <A href=index?name=terms><img src="images/layout_11.gif" width="95" height="42" alt="" border=0></A></td>
O1 - Hosts: <td>
O1 - Hosts: <img src="images/layout_12.gif" width="17" height="42" alt=""></td>
O1 - Hosts: <td colspan="3">
O1 - Hosts: <A href=index?name=about><img src="images/layout_13.gif" width="120" height="42" alt="" border=0></A></td>
O1 - Hosts: <td colspan="3" rowspan="2">
O1 - Hosts: <img src="images/layout_14.gif" width="232" height="68" alt=""></td>
O1 - Hosts: <td>
O1 - Hosts: <img src="images/spacer.gif" width="1" height="42" alt=""></td>
O1 - Hosts: </tr>
O1 - Hosts: <tr>
O1 - Hosts: <td colspan="12" rowspan="2">
O1 - Hosts: <img src="images/layout_15.gif" width="525" height="50" alt=""></td>
O1 - Hosts: <td rowspan="6">
O1 - Hosts: <img src="images/layout_16.gif" width="15" height="148" alt=""></td>
O1 - Hosts: <td>
O1 - Hosts: <img src="images/spacer.gif" width="1" height="26" alt=""></td>
O1 - Hosts: </tr>
O1 - Hosts: <tr>
O1 - Hosts: <td rowspan="3">
O1 - Hosts: <img src="images/layout_17.gif" width="34" height="71" alt=""></td>
O1 - Hosts: <td rowspan="3" background="images/layout_18.gif"> <form method=post action=login>
O1 - Hosts: <div align="center">
O1 - Hosts: <input type="text" name="id" size="12"><br>
O1 - Hosts: <br>
O1 - Hosts: <input type="password" name="pass" size="14">
O1 - Hosts: </div>
O1 - Hosts: <td rowspan="2">
O1 - Hosts: <img src="images/layout_19.gif" width="64" height="37" alt=""></td>
O1 - Hosts: <td>
O1 - Hosts: <img src="images/spacer.gif" width="1" height="24" alt=""></td>
O1 - Hosts: </tr>
O1 - Hosts: <tr>
O1 - Hosts: <td colspan="4" rowspan="3">
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DgnWebIE - {2843DAC1-05EF-11D2-95BA-0060083493D6} - C:\programma's\computer\ipaq\beeld en geluid\naturally speaking\dutch\setup\Program\web_ie.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\programma's\computer\beheer\beveiliging\norton antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\programma's\computer\beheer\beveiliging\norton antivirus\NavShExt.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\programma's\beeld en geluid\afbeelding\foto\Easy-WebPrint\Toolband.dll
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1601.0\nl\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~2\computer\beheer\BEVEIL~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [HI-SPEED USB DEVICE Coinstaller] PL15Co2K.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~2\computer\beheer\BEVEIL~1\Sygate\smc.exe -startgui
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [HP Software Update] C:\programma's\computer\ipaq\hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Bsa4D] C:\WINDOWS\cuydt.exe
O4 - HKLM\..\Run: [sys876] C:\WINDOWS\System32\sys876.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [seticlient] c:\programma's\twan\science\sterren\seti\SETI@home.exe -min
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\programma's\computer\ipaq\hp\WCESCOMM.EXE"
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Snelle start.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\programma's\beeld en geluid\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: RaConfig2500.lnk = C:\Program Files\RALINK\RT2500 Wireless LAN Card\Installer\WINXP\RaConfig2500.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~2\BEELDE~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\programma's\beeld en geluid\afbeelding\foto\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Toevoegen aan Mobiele favorieten - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - c:\programma's\computer\ipaq\hp\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - c:\programma's\computer\ipaq\hp\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Toevoegen aan Mobiele favorieten... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - c:\programma's\computer\ipaq\hp\INETREPL.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...ry/msgrchkr.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zon...er.cab27571.cab
O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} (PatchInstaller.Installer) - file://D:\content\include\XPPatchInstaller.CAB
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {6211AC26-A1B4-422A-AC52-1E70B7D24465} (FileSharingCtrl Class) - http://appdirectory....sharingctrl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {8731163E-77B9-4F91-9122-F112521C28AF} (MMSPlayerX Class) -
O16 - DPF: {8B1BC605-C593-4865-8F5B-05517F0CD0BB} (MSSecurityAdvisorCD Class) - file://D:\Content\include\msSecUcd.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...StatsClient.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zon...ro.cab32846.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai...5/Installer.exe
O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game18.zylomg...zylomloader.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zon...wn.cab28177.cab
O16 - DPF: {FE8287E9-5F43-11D3-ABCA-00105A5C1F46} (HouseCall Control) - http://www.housecall...call/xscan4.cab
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\programma's\computer\beheer\beveiliging\norton antivirus\navapsvc.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton Utilities\NPROTECT.EXE
O23 - Service: Prolific HotFix Q0306270 (PLQ0306270) - Unknown owner - C:\WINDOWS\System32\HotFixQ0306270.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\programma's\computer\beheer\beveiliging\Sygate\smc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\Program Files\Speed Disk\nopdb.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Could you help me with this problem?
  • 0




    retired HiJack Helper

  • Retired Staff
  • 5,080 posts
Welcome toy to Geeks to Go!

Sorry for the delay, the forums are very busy.

If you still need help, please post back here in this topic with a fresh log using HijackThis. Run the scan in normale mode.

If you solved the problem, please let me know.

As there has been no reply from the original poster for more than two weeks this topic is now closed.

If you are the original post and still need assistance, please send me a PM.

Edited by g2i2r4, 06 May 2005 - 11:45 AM.

  • 0

Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP