My HiJack This Log

I am having issues with the aurora spyware...here is a copy of my HiJack This log

Thank you in advance...Ronnie

Logfile of HijackThis v1.99.1
Scan saved at 2:17:59 PM, on 5/14/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Nsrdrt\Zedep.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\dming.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
c:\windows\system32\hwryan.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\WINDOWS\system32\dgr394.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\America Online 9.0\waol.exe
C:\Program Files\America Online 9.0\shellmon.exe
C:\Documents and Settings\Ronnie\Local Settings\Temporary Internet Files\Content.IE5\GNYB6LE5\HijackThis[1].exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hometown.aol....chmermpcom.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hometown.aol....chmermpcom.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Gncast] C:\Program Files\Nsrdrt\Zedep.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [5Frh3qX] dming.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [aflwofs] c:\windows\system32\hwryan.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Ko0nRkbqX] dgr394.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0\AOL.EXE" -b
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O15 - Trusted Zone: www.bestbuy.com
O16 - DPF: Greenback Bayou by pogo - http://game1.pogo.co...k-ob-assets.cab
O16 - DPF: Texas Hold'em Poker by pogo - http://game1.pogo.co...m-ob-assets.cab
O16 - DPF: Yahoo! Dominoes - http://download.game...ts/y/dot8_x.cab
O16 - DPF: Yahoo! Fleet - http://download.game...s/y/fltt3_x.cab
O16 - DPF: Yahoo! Literati - http://download.game...nts/y/tt3_x.cab
O16 - DPF: Yahoo! Poker - http://download.game...nts/y/pt3_x.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {75565ED2-1560-4F15-B841-20358DE6A0D1} (ImageControl Class) - http://c.ancestry.co...er/MFImgVwr.cab
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfi...ll/gtdownls.cab
O16 - DPF: {AFDD01B0-7ABB-11D9-9669-0800200C9A66} (MFInstall Class) - http://c.ancestry.co...l/MFInstall.cab
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.game...aploader_v6.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Please do not start new topics. Keep all posts in this thread. Topics merged. :tazz:

Edited by coachwife6, 15 May 2005 - 06:53 AM.

I am not sure if this is the log that is supposed to be posted re: help with aurora through ad aware summary. Please let me know and please help if possible. Thank you in advance.

ArchiveData(auto-quarantine- 2005-05-15 07-48-09.bckp)
Referencefile : SE1R45 13.05.2005
======================================================

VX2
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[0]=Regkey : S-1-5-21-854245398-507921405-839522115-1004\software\aurora
obj[1]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUI3d5OfSInst"
obj[2]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUC3n5trMsgSDisp"
obj[3]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUs3t5icky1S"
obj[4]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUs3t5icky2S"
obj[5]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUs3t5icky3S"
obj[6]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUs3t5icky4S"
obj[7]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUC1o3d5eOfSFinalAd"
obj[8]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUT3i5m7eOfSFinalAd"
obj[9]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUD3s5tSSEnd"
obj[10]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AU3N5a7tionSCode"
obj[11]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUP3D5om"
obj[12]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUT3h5rshSCheckSIn"
obj[13]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUT3h5rshSMots"
obj[14]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUM3o5deSSync"
obj[15]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUI3n5ProgSCab"
obj[16]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUI3n5ProgSEx"
obj[17]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUI3n5ProgSLstest"
obj[18]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUB3D5om"
obj[19]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUE3v5nt"
obj[20]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUT3h5rshSBath"
obj[21]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUT3h5rshSysSInf"
obj[22]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUL3n5Title"
obj[23]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUC3u5rrentSMode"
obj[24]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUC3n5tFyl"
obj[25]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUI3g5noreS"
obj[26]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUS3t5atusOfSInst"
obj[27]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUL3a5stMotsSDay"
obj[28]=RegValue : S-1-5-21-854245398-507921405-839522115-1004\software\aurora "AUL3a5stSSChckin"
obj[30]=File : C:\Program Files\Microsoft AntiSpyware\Quarantine\D9823A5B-504A-4BF5-968D-065963\B1EF47C5-A781-404C-9BA0-5CE25E
obj[32]=File : C:\System Volume Information\_restore{C90D3B08-C209-4FDD-8074-F704C3023DE0}\RP305\A0027081.exe

WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[29]=RegData : software\microsoft\windows nt\currentversion\winlogon "Shell"

MARKETSCORE(NETSETTER)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[31]=File : C:\System Volume Information\_restore{C90D3B08-C209-4FDD-8074-F704C3023DE0}\RP305\A0027080.exe

Being helped here:

http://www.geekstogo...3&p=122631&st=0

Edited by coachwife6, 15 May 2005 - 06:50 AM.

#1
heartofgold2372

Posted 14 May 2005 - 12:24 PM

Advertisements

#2
heartofgold2372

Posted 15 May 2005 - 06:09 AM

Similar Topics

0 user(s) are reading this topic

As Featured On:

Forums

Downloads

Members

Connect With Us