Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Possible malware infection

Started by maggi_g , Jun 03 2005 08:50 PM

  • Please log in to reply

#1
maggi_g
Posted 03 June 2005 - 08:50 PM

maggi_g

    New Member

  • Member
  • Pip
  • 6 posts
Hiya... I am working on de-funkifying my sisters Windows 2000 machine and am at my wit's end as to what the problem is. I've followed the instructions listed on this site: ran AdAware, SpyBot, CWShredder, Ewido Security, and Norton Anti-Virus to no avail. I still cannot connect to the Windows Update page (I get a 401 error... denied access to the page because it asks for a username and password). I am not sure if there is something new to updating Windows now, but I suspect this may be a malware problem. Please help!!! :tazz:

I've posted the HJT log below:

Logfile of HijackThis v1.99.1
Scan saved at 7:47:39 PM, on 6/3/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\2000\System32\smss.exe
C:\2000\system32\winlogon.exe
C:\2000\system32\services.exe
C:\2000\system32\lsass.exe
C:\2000\system32\svchost.exe
C:\2000\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\2000\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\2000\system32\GEARSEC.EXE
C:\2000\system32\hidserv.exe
C:\2000\system32\cba\pds.exe
C:\2000\System32\Hummingbird\Connectivity\7.00\Jconfig\jconfigdNT.exe
C:\PROGRA~1\Navnt\rtvscan.exe
C:\2000\system32\nvsvc32.exe
C:\2000\System32\pctspk.exe
C:\2000\system32\regsvc.exe
C:\2000\system32\MSTask.exe
C:\2000\system32\stisvc.exe
C:\Program Files\IntraPort Client\vpn5000service.exe
C:\2000\System32\WBEM\WinMgmt.exe
C:\2000\System32\mspmspsv.exe
C:\2000\system32\svchost.exe
C:\2000\system32\svchost.exe
C:\2000\System32\inetsrv\inetinfo.exe
C:\2000\system32\cba\xfr.exe
C:\2000\system32\MsgSys.EXE
C:\2000\Explorer.EXE
C:\PROGRA~1\Navnt\vpexrt.exe
C:\2000\system32\devldr32.exe
C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
C:\2000\system32\wuauclt.exe
C:\PROGRA~1\MOTHER~2\MBM5.EXE
C:\Program Files\Navnt\vptray.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Microsoft Hardware\Keyboard\speedkey.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
C:\Program Files\E-Color\Colorific\hgcctl95.exe
C:\Program Files\Iomega\Tools\IMGICON.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c.../search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\2000\downloaded program files\googletoolbar_en_2.0.114-deleon.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O2 - BHO: BrowserHelper Class - {EBCDDA60-2A68-11D3-8A43-0060083CFB9C} - C:\2000\System32\nzdd.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\2000\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\2000\downloaded program files\googletoolbar_en_2.0.114-deleon.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [UpdReg] C:\2000\Updreg.exe
O4 - HKLM\..\Run: [CountrySelection] pctptt.exe
O4 - HKLM\..\Run: [NewsUpd.exe] C:\Program Files\Creative\News\NewsUpd.exe /q
O4 - HKLM\..\Run: [MBM 5] C:\PROGRA~1\MOTHER~2\MBM5.EXE
O4 - HKLM\..\Run: [vptray] C:\Program Files\Navnt\vptray.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\2000\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Microsoft IntelliType Pro] "C:\Program Files\Microsoft Hardware\Keyboard\speedkey.exe"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive2k\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Colorific.lnk = C:\Program Files\E-Color\Colorific\hgcctl95.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check(2).lnk = C:\2000\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Iomega Backup Scheduler.lnk = C:\Program Files\Iomega\Iomega Backup\dtiom98.exe
O4 - Global Startup: Iomega Icons.lnk = C:\Program Files\Iomega\Tools\IMGICON.EXE
O4 - Global Startup: Iomega Startup Options.lnk = C:\Program Files\Iomega\Tools\IMGSTART.EXE
O4 - Global Startup: IomegaWare.lnk = C:\Program Files\Iomega\Iomegaware\COMMANDER.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: QuikSync.lnk = C:\Program Files\Iomega\QuikSync\QUIKSYNC.EXE
O4 - Global Startup: RealDownload.lnk = C:\Program Files\Real\RealDownload\RealDownload.exe
O8 - Extra context menu item: &Google Search - res://c:\2000\downloaded program files\GoogleToolbar_en_2.0.114-deleon.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\2000\downloaded program files\GoogleToolbar_en_2.0.114-deleon.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\2000\downloaded program files\GoogleToolbar_en_2.0.114-deleon.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\2000\downloaded program files\GoogleToolbar_en_2.0.114-deleon.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\2000\downloaded program files\GoogleToolbar_en_2.0.114-deleon.dll/cmtrans.html
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: Dialpad US Java Applet - http://www.dialpad.c...et/src/vscp.cab
O16 - DPF: Microsoft WFC Forms Designer - file://E:\VJ98\wfcforms.cab
O16 - DPF: Visual Studio 6 Extensibility Libraries - file://E:\VJ98\vstudio6.cab
O16 - DPF: {34805D32-AD89-469E-8503-A5666AEE4333} (RdxIE Class) - http://207.188.25.44...etzip/RdxIE.cab
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} - http://toolbar.googl...n/GoogleNav.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{528A3BB8-7D38-4B69-83BE-C21914FB6A5A}: NameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{E8B3D568-2E81-4BAD-895A-D69B52CD4F49}: NameServer = 206.13.31.12,206.13.28.12
O17 - HKLM\System\CCS\Services\Tcpip\..\{FEB4C5D3-D711-49E2-8C6F-1FEE61F7AD08}: NameServer = 216.39.128.2 216.39.128.6
O20 - Winlogon Notify: nwprovau - C:\2000\SYSTEM32\nwprovau.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\2000\System32\dmadmin.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: GEARSecurity - GEAR Software - C:\2000\system32\GEARSEC.EXE
O23 - Service: Intel File Transfer - Intel Corporation - C:\2000\system32\cba\xfr.exe
O23 - Service: Intel PDS - Intel Corporation - C:\2000\system32\cba\pds.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Hummingbird Jconfig Daemon (Jconfigd) - Hummingbird Ltd. - C:\2000\System32\Hummingbird\Connectivity\7.00\Jconfig\jconfigdNT.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\Navnt\rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\2000\system32\nvsvc32.exe
O23 - Service: PCtel speaker phone (pctspk) - PCtel, Inc. - C:\2000\System32\pctspk.exe
O23 - Service: VPN 5000 Service 1.00.00 (VPN5000Service) - Unknown owner - C:\Program Files\IntraPort Client\vpn5000service.exe
O23 - Service: ZipToA - Iomega Corporation - C:\2000\System32\ZipToA.exe

Thanks a bunch!
Maggi
  • 0

Advertisements

Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP