Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Hjack Log - can't seem to shake pop-ups

Started by la sweets , May 13 2005 11:45 AM

  • This topic is locked This topic is locked

#1
la sweets
Posted 13 May 2005 - 11:45 AM

la sweets

    New Member

  • Member
  • Pip
  • 4 posts
Here is my Hjack Log:

Logfile of HijackThis v1.99.1
Scan saved at 10:40:13 AM, on 5/13/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\McAfee\McAfee AntiSpyware\Msssrv.exe
C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\kristina beck\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by Cox High Speed Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [o97R37R] clrdmin.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [_AntiSpyware] C:\Program Files\McAfee\McAfee AntiSpyware\MssCli.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O16 - DPF: {00000000-0000-0000-0000-d4c4b96b0d97} -
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.co...rols/Rovion.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a224.g.akamai...meInstaller.exe
O16 - DPF: {50F65670-1729-11D2-A51F-0020AFE5D502} (ForumChat) - http://objects.compu...hat/RTCChat.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O18 - Protocol: burst - {2F2BA850-6714-11D4-8D0D-00B0D02A5D4E} - C:\WINDOWS\System32\BurstSourceFilter.ax
O20 - Winlogon Notify: RunOnceEx - C:\WINDOWS\system32\hr2605fse.dll
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: McAfee AntiSpyware Real-Time Scanner (McAfeeAntiSpyware) - Network Associates, Inc. - C:\Program Files\McAfee\McAfee AntiSpyware\Msssrv.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe

*I also have this log I did earlier from..err Panda I think it was called? Pardon me it's been a stressful couple days.

Incident Status Location

Adware:Adware/eZula No disinfected Windows Registry
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\unstall.exe
Adware:Adware/AdDestroyer No disinfected Windows Registry
Adware:Adware/VirtualBouncer No disinfected C:\WINDOWS\Downloaded Program Files\VBouncerOuter*.exe
Adware:Adware/ExactSearch No disinfected Windows Registry
Spyware:Spyware/ClientMan No disinfected C:\WINDOWS\SYSTEM32\msiaih.dll
Spyware:Spyware/Omi No disinfected C:\WINDOWS\SYSTEM32\msfdje.gif
Adware:Adware/PurityScan No disinfected C:\WINDOWS\TEMP\!update.exe
Adware:Adware/VirtualBouncer No disinfected C:\WINDOWS\Downloaded Program Files\VBouncerOuter1114.exe
Adware:Adware/eZula No disinfected C:\WINDOWS\Installer\89ac3.msi[unk_0037]
Adware:Adware/eZula No disinfected C:\WINDOWS\Installer\9b2ef5.msi[unk_0037]
Adware:Adware/eZula No disinfected C:\WINDOWS\Installer\fd86f.msi[unk_0037]
Adware:Adware/eZula No disinfected C:\WINDOWS\Installer\380b67.msi[unk_0037]
Adware:Adware/eZula No disinfected C:\WINDOWS\Installer\3f09cd.msi[unk_0037]
Adware:Adware/eZula No disinfected C:\WINDOWS\Installer\651de2.msi[unk_0037]
Adware:Adware/eZula No disinfected C:\WINDOWS\Installer\b8086.msi[unk_0037]
Adware:Adware/eZula No disinfected C:\WINDOWS\Installer\e448e.msi[unk_0037]
Spyware:Spyware/Media-motor No disinfected C:\WINDOWS\unstall.exe
Virus:Trj/Reboot.F Disinfected C:\HP\bin\Rebooter.exe
Adware:Adware/AdDestroyer No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\F9A67D2B-533C-405C-9945-13EA75\DA691C36-CF44-4621-84C7-97504A

Thanks
  • 0

Advertisements

#2
Guest_thatman_*
Posted 17 May 2005 - 02:55 AM

Guest_thatman_*
  • Guest
We can definitely help you, but first you need to help us. The first step in this process is to apply Service Pack 1a for Windows XP. Without this update, you're wide open to re-infection, and we're both just wasting our time.
Click here: http://www.microsoft...p1/default.mspx
Apply the update, reboot, and post a fresh Hijack This log.


Kc :tazz:
  • 0

#3
la sweets
Posted 17 May 2005 - 09:22 AM

la sweets

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
Um, when I follow the link to the Express install it doesn't show any updates available. I clicked on the installation history tab on the left and it looks like it tried in 2003 but I recived an error code 80070643. I noticed that none of the updates ever take. My friend at the time replaced my windows ME with this a few years ago.
  • 0

#4
Guest_thatman_*
Posted 17 May 2005 - 09:33 AM

Guest_thatman_*
  • Guest
Hi la sweets

You may not have a legal copy of windows read this link: http://support.microsoft.com/kb/822798

Try downloading the Service Pack from here and install it from your desktop.

http://www.softpedia...Pack-SP1a.shtml

Remember do not install Service Pack 2, as you will have major problems if you install that service pack without being clean first.

After installing SP1a reboot and post a new log.

Kc :tazz:
  • 0

#5
la sweets
Posted 17 May 2005 - 10:07 AM

la sweets

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
Ok well I tried to install it and got this "product key invalid...." so I'm guessing thats not a good thing :tazz:
  • 0

#6
Guest_thatman_*
Posted 17 May 2005 - 11:05 AM

Guest_thatman_*
  • Guest
Hi la sweets

I am sorry I can not help you forum rule's

Please read through the instructions before you start (you may want to print this out).

You are running HijackThis from the Desktop; please create a new folder for it and move the program into the new folder

Please set your system to show all files; please see here if you're unsure how to do this.

Reboot into Safe Mode: please see here if you are not sure how to do this.

Run ewido with a full scan

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items:
O4 - HKLM\..\Run: [o97R37R] clrdmin.exe
O16 - DPF: {00000000-0000-0000-0000-d4c4b96b0d97} -
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.co...rols/Rovion.cab
O18 - Protocol: burst - {2F2BA850-6714-11D4-8D0D-00B0D02A5D4E} - C:\WINDOWS\System32\BurstSourceFilter.ax
O20 - Winlogon Notify: RunOnceEx - C:\WINDOWS\system32\hr2605fse.dll
Click on Fix Checked when finished and exit HijackThis.

Using Windows Explorer, locate the following files/folders, and delete them:
clrdmin.exe<--Delete this file

Download Pocket Killbox and unzip it; save it to your Desktop.
Run killbox and click the radio button that says Delete a file on reboot.
Copy and Paste them one at a time into the full path of file to delete box and click the red circle with a white cross in it.
The program will ask you if you want to reboot; say No each time until the last one has been pasted in where upon you should answer Yes.
Let the system reboot.
C:\WINDOWS\unstall.exe
C:\WINDOWS\Downloaded Program Files\VBouncerOuter*.exe
C:\WINDOWS\SYSTEM32\msiaih.dll
C:\WINDOWS\SYSTEM32\msfdje.gif
C:\WINDOWS\TEMP\!update.exe
C:\WINDOWS\Downloaded Program Files\VBouncerOuter1114.exe
C:\WINDOWS\Installer\89ac3.msi[unk_0037]
C:\WINDOWS\Installer\9b2ef5.msi[unk_0037]
C:\WINDOWS\Installer\fd86f.msi[unk_0037]
C:\WINDOWS\Installer\380b67.msi[unk_0037]
C:\WINDOWS\Installer\3f09cd.msi[unk_0037]
C:\WINDOWS\Installer\651de2.msi[unk_0037]
C:\WINDOWS\Installer\b8086.msi[unk_0037]
C:\WINDOWS\Installer\e448e.msi[unk_0037]
C:\WINDOWS\unstall.exe
C:\HP\bin\Rebooter.exe
clrdmin.exe
C:\WINDOWS\System32\BurstSourceFilter.ax
C:\WINDOWS\system32\hr2605fse.dll
C:\Program Files\Microsoft AntiSpyware\Quarantine\F9A67D2B-533C-405C-9945-13EA75\DA691C36-CF44-4621-84C7-97504A

Please run the following free, online virus scans.
http://www.pandasoft...n_principal.htm
http://housecall.tre.../start_corp.asp
Please post the logs From Panda virus scan and HJT.logWe will need them to remove previous infections that have left files on your system.

All the best

Kc :tazz:
  • 0

#7
la sweets
Posted 17 May 2005 - 02:01 PM

la sweets

    New Member

  • Topic Starter
  • Member
  • Pip
  • 4 posts
:tazz: I understand

Should I just reinstall Windows ME? what was so bad about the program.
  • 0

#8
Guest_thatman_*
Posted 17 May 2005 - 02:33 PM

Guest_thatman_*
  • Guest
Your copy of windows xp is a pirate copy.

If you can afford to buy a legal copy that would be better.

Run with windows Me is not fully supported with windows update now
and to few tools for repairing me

All the best

Kc :tazz:
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP