WARNING: Windows Firewall detected suspicious network activity on your computer. Malicious software codes try to steal your privacy information, such as credit card numbers, electronic mail accounts, financial data or passwords.
Resetting IE home page always reverts to "about:blank."
It all started when I clicked on the following website & all [bleep] broke loose. My dialer started dialing an 800 toll number, and Zone Alarm started showing attempted registry changes. In google, it was the first hit for the search "italian mastiff cane corso". I *think* this is the link:
http://www.pet-x.com...an-mastiff.html
In Zone Alarm, a bunch of registry changes keep popping up, and won't allow me to "Deny Change." I can't paste the screen shots into this message.
Thanks so very much for any help!!
Here's the log:
hijackthis.log.txt 12.49KB
125 downloadsLogfile of HijackThis v1.99.1
Scan saved at 8:29:43 AM, on 6/23/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
D:\WIN2000\System32\smss.exe
D:\WIN2000\system32\winlogon.exe
D:\WIN2000\system32\services.exe
D:\WIN2000\system32\lsass.exe
D:\WIN2000\system32\svchost.exe
D:\WIN2000\system32\spoolsv.exe
D:\WIN2000\System32\PackethSvc.exe
D:\Apps\Internet\Security\BlackICE\blackd.exe
D:\Apps\_primary\Diskeeper\DKService.exe
D:\WIN2000\System32\svchost.exe
D:\Apps\_primary\ExpertCity\GoToMyPC\g2svc.exe
D:\WIN2000\system32\regsvc.exe
D:\Apps\_primary\ExpertCity\GoToMyPC\g2comm.exe
D:\WIN2000\system32\MSTask.exe
D:\WIN2000\System32\ups.exe
D:\WIN2000\system32\ZoneLabs\vsmon.exe
D:\Apps\_primary\ExpertCity\GoToMyPC\g2pre.exe
D:\Apps\_primary\ExpertCity\GoToMyPC\g2tray.exe
D:\WIN2000\System32\WFXSVC.EXE
D:\WIN2000\System32\WBEM\WinMgmt.exe
d:\apps\_primary\winfax\WFXMOD32.EXE
D:\WIN2000\System32\mspmspsv.exe
D:\WIN2000\system32\svchost.exe
D:\WIN2000\Explorer.EXE
D:\WIN2000\system32\devldr32.exe
D:\apps\m-media\Creative\SBLive2k\Launcher\CTLauncher.exe
D:\WIN2000\system32\wfxsnt40.exe
D:\Apps\_Utils\Pop-Up Stopper\dpps2.exe
D:\Program Files\HPIS\motmon.exe
D:\Apps\M-Media\Total Recorder\TotRecSched.exe
D:\apps\m-media\QuikTime\qttask.exe
D:\Program Files\BroadJump\Client Foundation\CFD.exe
D:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe
D:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe
D:\Apps\M-Media\iTunes\iTunesHelper.exe
D:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
D:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
D:\Apps\Google\Picasa2\PicasaMediaDetector.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\WIN2000\sysxh32.exe
D:\WIN2000\system32\internat.exe
D:\WIN2000\apiux.exe
D:\WIN2000\System32\rsvp.exe
D:\Apps\Viewers\Zinio\ZDLM.exe
D:\Apps\_Utils\Spybot - Search & Destroy\TeaTimer.exe
D:\Program Files\Photoleap\Photoleap.exe
D:\Apps\_primary\Adobe\Acrobat\Distillr\AcroTray.exe
D:\Apps\Internet\Security\BlackICE\blackice.exe
D:\Apps\_Utils\GuruNet\GuruNet.exe
D:\Program Files\Common Files\efax\HotTray.exe
D:\Program Files\Common Files\efax\Dllcmd32.exe
D:\PROGRA~1\COMMON~1\ATOMIC~1\agtserv.exe
D:\WIN2000\FSScrCtl.exe
D:\DOCUME~1\Si\LOCALS~1\Temp\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://livepage.appl.../?isp=earthlink
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink...ton/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bigfoo...ef=MS_SearchBar
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://D:\WIN2000\system32\hdyps.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://D:\WIN2000\system32\hdyps.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://D:\WIN2000\system32\hdyps.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://D:\WIN2000\system32\hdyps.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://D:\WIN2000\system32\hdyps.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=CookieCop:8100;https=CookieCop:8100
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Apps\_primary\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O2 - BHO: Class - {BF1DF99D-6BD4-9618-1150-AB8EA227AC2B} - D:\WIN2000\system32\crtf32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WIN2000\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {46AE04C0-BCFA-4728-90E7-00EB4A8B3863} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [UpdReg] D:\WIN2000\Updreg.exe
O4 - HKLM\..\Run: [Creative Launcher] d:\apps\m-media\Creative\SBLive2k\Launcher\CTLauncher.exe
O4 - HKLM\..\Run: [AudioHQ] d:\apps\m-media\Creative\SBLive2k\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [RegShave] C:\Progra~1\REGSHAVE\REGSHAVE.EXE /autorun
O4 - HKLM\..\Run: [Pop-Up Stopper] "D:\Apps\_Utils\Pop-Up Stopper\dpps2.exe"
O4 - HKLM\..\Run: [ActiveEyes] D:\Apps\_Utils\Active Eyes\tfieyes.exe
O4 - HKLM\..\Run: [MotiveMonitor] D:\Program Files\HPIS\motmon.exe
O4 - HKLM\..\Run: [HP Instant Support] D:\PROGRA~1\HPIS\bin\mpbtn.exe
O4 - HKLM\..\Run: [MotiveBootKey] D:\PROGRA~1\HPIS\bin\mad.exe
O4 - HKLM\..\Run: [TotalRecorderScheduler] "D:\Apps\M-Media\Total Recorder\TotRecSched.exe"
O4 - HKLM\..\Run: [QuickTime Task] D:\apps\m-media\QuikTime\qttask.exe -atboottime
O4 - HKLM\..\Run: [BJCFD] D:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "D:\Program Files\Visual Networks\Visual IP InSight\SBC\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "D:\Program Files\Visual Networks\Visual IP InSight\SBC\IPMon32.exe"
O4 - HKLM\..\Run: [Motive SmartBridge] D:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [iTunesHelper] D:\Apps\M-Media\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [ViewMgr] D:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Picasa Media Detector] D:\Apps\Google\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [Zone Labs Client] D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [GoToMyPC] D:\Apps\_primary\ExpertCity\GoToMyPC\g2svc.exe -logon
O4 - HKLM\..\Run: [sysxh32.exe] D:\WIN2000\sysxh32.exe
O4 - HKLM\..\Run: [mgavrtclexe] D:\WIN2000\MCBin\AV\Rt\mgavrtcl.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunOnce: [StartStop] D:\Apps\_Utils\Start-Stop\startstop.exe /startup
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [MSMSGS] D:\Program Files\Messenger\msmsgs.exe /background
O4 - HKCU\..\Run: [updateMgr] D:\Apps\_primary\Adobe\Acrobat 6.0\Reader\AdobeUpdateManager.exe Reader6 -reboot 1
O4 - HKCU\..\Run: [Zinio DLM] D:\Apps\Viewers\Zinio\ZDLM.exe /hide
O4 - HKCU\..\Run: [Yahoo! Pager] 1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Apps\_Utils\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Photoleap] D:\Program Files\Photoleap\Photoleap.exe -silent
O4 - HKCU\..\RunOnce: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - Startup: Microsoft Outlook.lnk = D:\Apps\_primary\msOffice\Office\OUTLOOK.EXE
O4 - Startup: My PowerDesk.lnk = D:\Apps\_Utils\PowerDesk\PDExplo.exe
O4 - Startup: Screen Saver Control.lnk = D:\WIN2000\FSScrCtl.exe
O4 - Startup: Shortcut to blackice.exe.lnk = D:\Apps\Internet\Security\BlackICE\blackice.exe
O4 - Global Startup: Acrobat Assistant.lnk = D:\Apps\_primary\Adobe\Acrobat\Distillr\AcroTray.exe
O4 - Global Startup: BlackICE Utility.lnk = D:\Apps\Internet\Security\BlackICE\blackice.exe
O4 - Global Startup: GuruNet.lnk = D:\Apps\_Utils\GuruNet\GuruNet.exe
O4 - Global Startup: j2 Tray Menu.lnk = D:\Program Files\Common Files\efax\HotTray.exe
O4 - Global Startup: Live Menu.lnk = D:\Program Files\Common Files\efax\Dllcmd32.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Apps\_primary\msOffice\Office\OSA9.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = D:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://d:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://d:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Browster preload on/off - res://D:\Apps\_Utils\Browster\Browster.dll/CustomPrefetchMenu.htm
O8 - Extra context menu item: Cached Snapshot of Page - res://d:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: GuruNet... - file:D:\Apps\_Utils\GuruNet\Html\atiemenu.htm
O8 - Extra context menu item: Search Using Copernic Agent - res://D:\Apps\Internet\Search\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: Similar Pages - res://d:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://d:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WIN2000\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WIN2000\system32\msjava.dll
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\Apps\Internet\Search\COPERN~2\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - D:\Apps\Internet\Search\COPERN~2\COPERN~1.EXE
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - D:\Apps\Internet\Phones\Net2Phone\Net2fone.exe
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - D:\Apps\Internet\Phones\Net2Phone\Net2fone.exe
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - D:\Apps\Internet\Search\COPERN~2\COPERN~1.EXE
O9 - Extra button: Photoleap - {749A7E5B-0C26-47b2-B6B3-E1F811D6643B} - D:\Program Files\Photoleap\PLShell.DLL
O9 - Extra 'Tools' menuitem: Photoleap - {749A7E5B-0C26-47b2-B6B3-E1F811D6643B} - D:\Program Files\Photoleap\PLShell.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - D:\WIN2000\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .hcvm: D:\Program Files\Internet Explorer\PLUGINS\NPAXHyp.dll
O16 - DPF: {0837121A-6472-43BD-8A40-D9221FF1C4CE} -
O16 - DPF: {21157916-4d49-11d4-a3e0-00c04fa32518} -
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg...l_v1-0-3-17.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zone...ctor/WebAAS.cab
O16 - DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} (Java Plug-in 1.4.2_05) -
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.c...ebio5_1_6_0.cab
O16 - DPF: {F7A05BAC-9778-410A-9CDE-BFBD4D5D2B7F} (iPIX Media Send Class) - http://216.249.24.60...geWell-ipix.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = stmnca.adelphia.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = stmnca.adelphia.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = stmnca.adelphia.net
O23 - Service: McAfee.com AV Engine (AsEngine) - Network Associates, Inc. - D:\WIN2000\mcbin\av\rt\asengine.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - D:\Apps\Internet\Security\BlackICE\blackd.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - D:\Apps\_primary\Diskeeper\DKService.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - D:\WIN2000\System32\dmadmin.exe
O23 - Service: GoToMyPC - Unknown owner - D:\Apps\_primary\ExpertCity\GoToMyPC\g2svc.exe" -service (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Virtual NIC Service (PackethSvc) - America Online, Inc. - D:\WIN2000\System32\PackethSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - D:\WIN2000\system32\ZoneLabs\vsmon.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - D:\WIN2000\System32\WFXSVC.EXE
Sign In
Create Account
