Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works

transponder btgrab? with hijackthislog

  • Please log in to reply



    New Member

  • Member
  • Pip
  • 1 posts
My Aluria software detects transponder btgrab. I've "removed" it using the Aluria software only to have it come back almost immediately. Under variants/paths, for a long time there were temporary (and maybe some program) files with turbocache in the name. Most recently, there is a list of all of my recently received cookies, normally innocuous, under variants/paths. Here is the hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 12:26:24 PM, on 7/15/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Aluria Security Center\SecurityCenter.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe
C:\Program Files\NetZero\exec.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmon.exe
C:\Program Files\Aluria Software\DrSpeed Suite\drspeed.exe
C:\Program Files\NetZero\exec.exe
C:\Program Files\NetZero\qsacc\x1exec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner.TIM-MYN9KZ33DDD\Local Settings\Temp\Temporary Directory 2 for hijackthis[1].zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://my.netzero.ne...ch?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.ne...ch?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.ne...ch?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.ne...ch?r=minisearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.netzero.ne...ch?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.ne...ch?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://my.netzero.ne...=A&UT=companion
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =;;;searchap.untd.com;;localhost;*update.microsoft.com;*windowsupdate.com;*wustat.windows.com;*.pogo.com;*test-speed.com;liveupdate.symantecliveupdate.com;*symantec.com;*.nai.com;*.networkassociates.com;<local>
R3 - URLSearchHook: URLSearchHook Class - {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\Program Files\NZSearch\SearchEnh1.dll
O1 - Hosts: :\WINDOWS\System32\shdoclc.dll
O1 - Hosts: address.mail.yahoo.com
O1 - Hosts: castlecops.com
O1 - Hosts: dictionary.cambridge.org
O1 - Hosts: dictionary.reference.com
O1 - Hosts: didos.com
O1 - Hosts: dir.yahoo.com
O1 - Hosts: download.zonelabs.com
O1 - Hosts: en.wikipedia.org
O1 - Hosts: encarta.msn.com
O1 - Hosts: feedback.privatevoyeurs.com
O1 - Hosts: filesharingtalk.com
O1 - Hosts: forums.zonelabs.com
O1 - Hosts: french.about.com
O1 - Hosts: french-word-a-day.typepad.com
O1 - Hosts: images.google.com
O1 - Hosts: images.search.yahoo.com
O1 - Hosts: info.ahnlab.com
O1 - Hosts: labs.paretologic.com
O1 - Hosts: login.yahoo.com
O1 - Hosts: mail.yahoo.com
O1 - Hosts: my.netzero.net
O1 - Hosts: netrn.net
O1 - Hosts: northwestern.scout.com
O1 - Hosts: oca.microsoft.com
O1 - Hosts: owa.hospital.uic.edu
O1 - Hosts: scout.scout.com
O1 - Hosts: search.msn.com
O1 - Hosts: search.netzero.net
O1 - Hosts: search.yahoo.com
O1 - Hosts: slate.msn.com
O1 - Hosts: support.microsoft.com
O1 - Hosts: travlang.com
O1 - Hosts: unabridged.merriam-webster.com
O1 - Hosts: update.microsoft.com
O1 - Hosts: us.f537.mail.yahoo.com
O1 - Hosts: www.aluriasoftware.com
O1 - Hosts: www.askoxford.com
O1 - Hosts: www.bloomsbury.com
O1 - Hosts: www.cbs.com
O1 - Hosts: www.coachwyatt.com
O1 - Hosts: www.doxdesk.com
O1 - Hosts: www.google.com
O1 - Hosts: www.gu.edu.au
O1 - Hosts: www.hijack-this.net
O1 - Hosts: www.hospital.uic.edu
O1 - Hosts: www.infoplease.com
O1 - Hosts: www.majorgeeks.com
O1 - Hosts: www.mandaeanworld.com
O1 - Hosts: www.metacritic.com
O1 - Hosts: www.microsoft.com
O1 - Hosts: www.msn.com
O1 - Hosts: www.m-w.com
O1 - Hosts: www.nflhs.com
O1 - Hosts: www.nhri.go.kr
O1 - Hosts: www.niagaracave.com
O1 - Hosts: www.nytimes.com
O1 - Hosts: www.oed.com
O1 - Hosts: www.onelook.com
O1 - Hosts: www.oskie.com
O1 - Hosts: www.pctools.com
O1 - Hosts: www.peytonmanning.ws
O1 - Hosts: www.pitchforkmedia.com
O1 - Hosts: www.probertencyclopaedia.com
O1 - Hosts: www.religionfacts.com
O1 - Hosts: www.studyspanish.com
O1 - Hosts: www.swingline.com
O1 - Hosts: www.thespywarelist.com
O1 - Hosts: www.timesonline.co.uk
O1 - Hosts: www.tomcoyote.org
O1 - Hosts: www.transparent.com
O1 - Hosts: www.usafootball.com
O1 - Hosts: www.uwgb.edu
O1 - Hosts: www.vedanta.org
O1 - Hosts: www.vocabvitamins.com
O1 - Hosts: www.webhelper4u.com
O1 - Hosts: www.wordsmith.org
O1 - Hosts: www.wordspy.com
O1 - Hosts: www.wordthink.com
O1 - Hosts: www.yahoo.com
O1 - Hosts: www.yourdictionary.com
O2 - BHO: X1IEHook Class - {52706EF7-D7A2-49AD-A615-E903858CF284} - C:\Program Files\NetZero\qsacc\X1IEBHO.dll
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\toolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [Aluria Security Center] C:\Program Files\Aluria Security Center\SecurityCenter.exe /minimize
O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe"
O4 - HKCU\..\Run: [NetZero_uoltray] C:\Program Files\NetZero\exec.exe regrun
O4 - HKCU\..\Run: [spc_w] "C:\Program Files\NZSearch\nzspc.exe" -w
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - HKCU\..\RunOnce: [untd_recovery] C:\Program Files\NetZero\qsacc\x1exec.exe
O4 - Global Startup: Dr.Speed NetRx.lnk = C:\Program Files\Aluria Software\DrSpeed Suite\drspeed.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{63E12CA9-062E-42C9-B827-675184A6A2F1}: NameServer =
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Aluria Security Center Spyware Eliminator Service (ASCService) - Unknown owner - C:\Program Files\Aluria Security Center\ascserv.exe
O23 - Service: asKernel - Unknown owner - C:\PROGRA~1\ALURIA~2\asKernel.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\System32\ZoneLabs\isafe.exe
O23 - Service: dlbt_device - Dell - C:\WINDOWS\System32\dlbtcoms.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

Please help,
  • 0





  • Retired Staff
  • 11,413 posts
Hi 9a. Sorry you were overlooked. Did you resolve this issue or do you still need assistance? If so, please run Hijack This and post the log in this thread and I'll take a look at it. :tazz:
  • 0

Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP