Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

** Please analyze my HJT Log ** [RESOLVED]

Started by man_vs_spyware , Jun 06 2005 07:30 AM

  • This topic is locked This topic is locked

#1
man_vs_spyware
Posted 06 June 2005 - 07:30 AM

man_vs_spyware

    Member

  • Member
  • PipPip
  • 10 posts
Hi there.

I'm on my dad's machine at the moment. He has something nasty on here. It seems obvious that some bugger is using the machine to attack others, because as stated in the topic description, he has 8,589,936,267 packets sent and counting, with 106,000 some odd received. No joke. I've followed the steps in the sticky topic before posting my HJT log. Check out all those processes - randomly generated exe reaking havoc, need help! Here it is!

==================================================

Logfile of HijackThis v1.99.1
Scan saved at 9:14:04 AM, on 6/6/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Plaxo\2.1.0.80\InstallStub.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\p0i70g.exe
C:\WINDOWS\system32\p0i70g.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\p0i70g.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\p0i70g.exe
C:\Program Files\Real\RealPlayer\rphelperapp.exe
C:\Program Files\Real\RealPlayer\rphelperapp.exe
C:\WINDOWS\system32\p0i70g.exe
C:\WINDOWS\system32\p0i70g.exe
C:\WINDOWS\system32\p0i70g.exe
C:\WINDOWS\system32\p0i70g.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\p0i70g.exe
C:\WINDOWS\system32\p0i70g.exe
C:\WINDOWS\system32\p0i70g.exe
C:\WINDOWS\system32\p0i70g.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\p0i70g.exe
C:\WINDOWS\system32\p0i70g.exe
C:\WINDOWS\system32\p0i70g.exe
C:\WINDOWS\system32\p0i70g.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\p0i70g.exe
C:\Documents and Settings\Censored\My Documents\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.geekstogo.com/
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4A25D449-2BAA-4426-A992-D18CA70CF5A9} - C:\WINDOWS\system32\p5pxrz.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe /server"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [_Cat3] C:\WINDOWS\msmsgrxp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AdwareAlert] C:\Program Files\AdwareAlert\AdwareAlert.Exe -boot
O4 - HKLM\..\RunOnce: [e0u8ff.exe] C:\WINDOWS\system32\e0u8ff.exe /k
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [tgcmd] C:\Program Files\Support.com\bin\tgcmd.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.1.0.80\InstallStub.exe -a
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: ppctlcab - http://www.pestscan....er/ppctlcab.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zone...ctor/WebAAS.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

==================================================

Thanks so much.
  • 0

Advertisements

#2
Guest_usetobe_*
Posted 06 June 2005 - 07:56 AM

Guest_usetobe_*
  • Guest
Hi Man Vs Spyware,

Lets see what we can do with this.

Lets start off by removing Adaware Alert in add/remove in control panel as that is a program of dubious nature.

Carry out a free online virus scan from the following link. Type in name, for company type anything you like, add email address in relevant boxes.

Kaspersky

Download a free 14 day trial of ewido from the link below. Install it and start it up. Follow the prompts to upgrade it, then close it down.

ewido

Please download Cleanup from here:

Cleanup. Do not run it yet.

Set PC to show hidden files (click link if you do not know how)LINK

Boot into Safe Mode:
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Then please run Ewido, and run a full scan. This may take some time, so go grab a coffee. Once it finds the first issue tick the box for all. Post the log from the scan here for me.

Now scan with HJT and check the following entries if they are there. Some may have been removed by earlier procedures.

O2 - BHO: (no name) - {4A25D449-2BAA-4426-A992-D18CA70CF5A9} - C:\WINDOWS\system32\p5pxrz.dll
O4 - HKLM\..\Run: [_Cat3] C:\WINDOWS\msmsgrxp.exe
O4 - HKLM\..\Run: [AdwareAlert] C:\Program Files\AdwareAlert\AdwareAlert.Exe -boot
O4 - HKLM\..\RunOnce: [e0u8ff.exe] C:\WINDOWS\system32\e0u8ff.exe /k

Ensure no windows open except HJT and ckick FIX CHECKED.

NOW USING WINDOWS EXPLORER LOCATE AND DELETE THE FOLLOWING FILES/FOLDERS , IF FOUND

C:\WINDOWS\system32\p5pxrz.dll
C:\WINDOWS\msmsgrxp.exe
C:\Program Files\AdwareAlert\AdwareAlert.Exe
C:\WINDOWS\system32\e0u8ff.exe
C:\WINDOWS\system32\u2aj36p.exe
C:\WINDOWS\system32\p0i70g.exe

Now run cleanup to clear out temp files junk etc.

Reboot normally, rescan with HJT and post the log back with the ewido log
  • 0

#3
man_vs_spyware
Posted 06 June 2005 - 07:13 PM

man_vs_spyware

    Member

  • Topic Starter
  • Member
  • PipPip
  • 10 posts
Thanks very much for your timely reply, usetobe.

Here is my HJT log. I couldn't find the ewido log... but I can tell you it quarantined 4 Trojan.Delf.cf


=============================================
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe /server"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [_Cat3] C:\WINDOWS\msmsgrxp.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AdwareAlert] C:\Program Files\AdwareAlert\AdwareAlert.Exe -boot
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\RunOnce: [e0u8ff.exe] C:\WINDOWS\system32\e0u8ff.exe /k
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [tgcmd] C:\Program Files\Support.com\bin\tgcmd.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.1.0.80\InstallStub.exe -a
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: ppctlcab - http://www.pestscan....er/ppctlcab.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.../kavwebscan.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zone...ctor/WebAAS.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
=============================================

Thanks again.
  • 0

#4
Guest_usetobe_*
Posted 07 June 2005 - 01:22 AM

Guest_usetobe_*
  • Guest
Please repost the full HJT log, including the header
  • 0

#5
man_vs_spyware
Posted 07 June 2005 - 05:19 PM

man_vs_spyware

    Member

  • Topic Starter
  • Member
  • PipPip
  • 10 posts
Logfile of HijackThis v1.99.1
Scan saved at 7:19:20 PM, on 6/7/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Plaxo\2.1.0.80\InstallStub.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Adobe\Acrobat 6.0\Reader\AcroRd32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.drudgereport.com/
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Tgcmd] "C:\Program Files\Support.com\bin\tgcmd.exe /server"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [tgcmd] C:\Program Files\Support.com\bin\tgcmd.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.1.0.80\InstallStub.exe -a
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: ppctlcab - http://www.pestscan....er/ppctlcab.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.../kavwebscan.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zone...ctor/WebAAS.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  • 0

#6
Guest_usetobe_*
Posted 07 June 2005 - 05:32 PM

Guest_usetobe_*
  • Guest
Hi again,

From your log, I see nothing in the ways of trojans, nor any evil entities attempting to possess your computer, except for Windows but it's too late for that one. :tazz:

Congratulations your log now appears to be clean. ;)

Here are some tips, to reduce the potential for spyware infection in the future, I strongly recommend installing the following applications:

Detect and Remove Programs:
  • How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
  • How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.
Prevention Programs:
  • Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
  • Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts.
  • IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
  • Google Toolbar <= Get the free google toolbar to help stop pop up windows.
Other necessary Programs:
  • AntiVirus Program<= An AntiVirus program is a must! Whether it is a free version like AVG or Anti-Vir, or a shareware version like Norton or Kapersky, this is a must have.
  • Firewall<= A firewall is definatley a must have. Two good free versions are Sygate and ZoneLabs.
  • More Secure Browser<= Internet Explorer is not the most secure and best browser. There are safer and better alternatives available. I recommend Firefox, however Opera and SlimBrowsers are good as well.
And also see TonyKlein's good advice
So how did I get infected in the first place? and AntiSpyware Net's spyware article: Spyware, Adware, Malware: What it is, how it got on my computer, how to get rid of it, and how to prevent it.
  • 0

#7
Guest_usetobe_*
Posted 27 June 2005 - 07:53 AM

Guest_usetobe_*
  • Guest
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :tazz:

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP