Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

transponder btgrab? with hijackthislog


  • Please log in to reply

#1
9a5y23

9a5y23

    New Member

  • Member
  • Pip
  • 1 posts
My Aluria software detects transponder btgrab. I've "removed" it using the Aluria software only to have it come back almost immediately. Under variants/paths, for a long time there were temporary (and maybe some program) files with turbocache in the name. Most recently, there is a list of all of my recently received cookies, normally innocuous, under variants/paths. Here is the hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 12:26:24 PM, on 7/15/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALURIA~2\asKernel.exe
C:\WINDOWS\System32\ZoneLabs\isafe.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Aluria Security Center\SecurityCenter.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe
C:\Program Files\NetZero\exec.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmon.exe
C:\Program Files\Aluria Software\DrSpeed Suite\drspeed.exe
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\NetZero\exec.exe
C:\Program Files\NetZero\qsacc\x1exec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner.TIM-MYN9KZ33DDD\Local Settings\Temp\Temporary Directory 2 for hijackthis[1].zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://my.netzero.ne...ch?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.ne...ch?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.ne...ch?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.ne...ch?r=minisearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.netzero.ne...ch?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.ne...ch?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://my.netzero.ne...=A&UT=companion
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:7900
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 64.136.29.30;64.136.21.30;64.136.29.34;searchap.untd.com;127.0.0.1;localhost;*update.microsoft.com;*windowsupdate.com;*wustat.windows.com;*.pogo.com;*test-speed.com;liveupdate.symantecliveupdate.com;*symantec.com;*.nai.com;*.networkassociates.com;<local>
R3 - URLSearchHook: URLSearchHook Class - {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\Program Files\NZSearch\SearchEnh1.dll
O1 - Hosts: 64.136.21.190 :\WINDOWS\System32\shdoclc.dll
O1 - Hosts: 68.142.197.57 address.mail.yahoo.com
O1 - Hosts: 209.213.221.238 castlecops.com
O1 - Hosts: 193.60.94.200 dictionary.cambridge.org
O1 - Hosts: 66.161.12.81 dictionary.reference.com
O1 - Hosts: 64.89.22.128 didos.com
O1 - Hosts: 66.218.71.192 dir.yahoo.com
O1 - Hosts: 216.52.219.149 download.zonelabs.com
O1 - Hosts: 207.142.131.236 en.wikipedia.org
O1 - Hosts: 207.46.167.100 encarta.msn.com
O1 - Hosts: 66.230.161.83 feedback.privatevoyeurs.com
O1 - Hosts: 63.246.151.207 filesharingtalk.com
O1 - Hosts: 198.87.31.87 forums.zonelabs.com
O1 - Hosts: 208.185.127.40 french.about.com
O1 - Hosts: 66.151.149.10 french-word-a-day.typepad.com
O1 - Hosts: 216.239.53.104 images.google.com
O1 - Hosts: 216.109.117.135 images.search.yahoo.com
O1 - Hosts: 211.233.80.87 info.ahnlab.com
O1 - Hosts: 72.3.254.66 labs.paretologic.com
O1 - Hosts: 66.218.75.184 login.yahoo.com
O1 - Hosts: 216.109.127.60 mail.yahoo.com
O1 - Hosts: 64.136.29.230 my.netzero.net
O1 - Hosts: 66.150.196.56 netrn.net
O1 - Hosts: 216.187.121.100 northwestern.scout.com
O1 - Hosts: 131.107.112.111 oca.microsoft.com
O1 - Hosts: 128.248.202.152 owa.hospital.uic.edu
O1 - Hosts: 216.187.121.104 scout.scout.com
O1 - Hosts: 166.90.137.38 search.msn.com
O1 - Hosts: 64.136.29.190 search.netzero.net
O1 - Hosts: 68.142.236.54 search.yahoo.com
O1 - Hosts: 65.54.159.118 slate.msn.com
O1 - Hosts: 207.46.248.248 support.microsoft.com
O1 - Hosts: 128.121.48.71 travlang.com
O1 - Hosts: 63.240.197.83 unabridged.merriam-webster.com
O1 - Hosts: 207.46.199.93 update.microsoft.com
O1 - Hosts: 206.190.37.21 us.f537.mail.yahoo.com
O1 - Hosts: 64.94.239.39 www.aluriasoftware.com
O1 - Hosts: 12.107.205.43 www.askoxford.com
O1 - Hosts: 213.219.55.35 www.bloomsbury.com
O1 - Hosts: 170.20.0.24 www.cbs.com
O1 - Hosts: 209.238.200.92 www.coachwyatt.com
O1 - Hosts: 64.251.25.168 www.doxdesk.com
O1 - Hosts: 66.102.7.104 www.google.com
O1 - Hosts: 132.234.250.230 www.gu.edu.au
O1 - Hosts: 67.18.199.2 www.hijack-this.net
O1 - Hosts: 128.248.104.47 www.hospital.uic.edu
O1 - Hosts: 165.193.123.186 www.infoplease.com
O1 - Hosts: 67.19.72.100 www.majorgeeks.com
O1 - Hosts: 66.218.79.173 www.mandaeanworld.com
O1 - Hosts: 64.74.172.162 www.metacritic.com
O1 - Hosts: 207.46.199.60 www.microsoft.com
O1 - Hosts: 207.68.171.245 www.msn.com
O1 - Hosts: 12.129.203.36 www.m-w.com
O1 - Hosts: 216.12.130.133 www.nflhs.com
O1 - Hosts: 203.241.59.3 www.nhri.go.kr
O1 - Hosts: 137.192.98.59 www.niagaracave.com
O1 - Hosts: 199.239.137.245 www.nytimes.com
O1 - Hosts: 171.66.121.79 www.oed.com
O1 - Hosts: 216.235.250.171 www.onelook.com
O1 - Hosts: 66.29.135.59 www.oskie.com
O1 - Hosts: 65.61.181.240 www.pctools.com
O1 - Hosts: 65.254.59.194 www.peytonmanning.ws
O1 - Hosts: 70.84.101.130 www.pitchforkmedia.com
O1 - Hosts: 216.234.186.84 www.probertencyclopaedia.com
O1 - Hosts: 67.138.240.9 www.religionfacts.com
O1 - Hosts: 198.65.152.173 www.studyspanish.com
O1 - Hosts: 216.141.153.233 www.swingline.com
O1 - Hosts: 69.56.139.2 www.thespywarelist.com
O1 - Hosts: 143.252.148.161 www.timesonline.co.uk
O1 - Hosts: 70.84.70.85 www.tomcoyote.org
O1 - Hosts: 207.228.213.98 www.transparent.com
O1 - Hosts: 216.12.136.102 www.usafootball.com
O1 - Hosts: 143.200.128.158 www.uwgb.edu
O1 - Hosts: 67.18.62.98 www.vedanta.org
O1 - Hosts: 69.59.178.108 www.vocabvitamins.com
O1 - Hosts: 68.142.234.45 www.webhelper4u.com
O1 - Hosts: 216.12.219.209 www.wordsmith.org
O1 - Hosts: 216.119.77.252 www.wordspy.com
O1 - Hosts: 209.196.48.26 www.wordthink.com
O1 - Hosts: 216.109.117.109 www.yahoo.com
O1 - Hosts: 64.241.74.201 www.yourdictionary.com
O2 - BHO: X1IEHook Class - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\Program Files\NetZero\qsacc\X1IEBHO.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\toolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [Aluria Security Center] C:\Program Files\Aluria Security Center\SecurityCenter.exe /minimize
O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe"
O4 - HKCU\..\Run: [NetZero_uoltray] C:\Program Files\NetZero\exec.exe regrun
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\nzspc.exe" -w
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\RunOnce: [untd_recovery] C:\Program Files\NetZero\qsacc\x1exec.exe
O4 - Global Startup: Dr.Speed NetRx.lnk = C:\Program Files\Aluria Software\DrSpeed Suite\drspeed.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{63E12CA9-062E-42C9-B827-675184A6A2F1}: NameServer = 64.136.28.120 64.136.20.120
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Aluria Security Center Spyware Eliminator Service (ASCService) - Unknown owner - C:\Program Files\Aluria Security Center\ascserv.exe
O23 - Service: asKernel - Unknown owner - C:\PROGRA~1\ALURIA~2\asKernel.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\System32\ZoneLabs\isafe.exe
O23 - Service: dlbt_device - Dell - C:\WINDOWS\System32\dlbtcoms.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

Please help,
Thanks,
Tim
  • 0

Advertisements


#2
coachwife6

coachwife6

    SuperStar

  • Retired Staff
  • 11,413 posts
Hi 9a. Sorry you were overlooked. Did you resolve this issue or do you still need assistance? If so, please run Hijack This and post the log in this thread and I'll take a look at it. :tazz:
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP