Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Really weird!

Started by Dark_Side , Jul 17 2005 09:57 AM

  • This topic is locked This topic is locked

#1
Dark_Side
Posted 17 July 2005 - 09:57 AM

Dark_Side

    Member

  • Member
  • PipPipPip
  • 303 posts
ok, so i scanned ad aware, ewido, panda, trend housecall, avg, cleanup and all found nothing.

i then scanned Spybot and there! It found the following:

Cool WWW Search
Double Click
E-Music A
Mysearch
MyWay.MyBar

But that's not all! You guys told me my HJT log was clean right before SPybot found those entries. here is a new log if it will help!

Logfile of HijackThis v1.99.1
Scan saved at 5:52:07 PM, on 7/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\Village Idiot\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.geekstogo...forum/index.php
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.co...UC/MsnPUpld.cab
O16 - DPF: {5D1E3FA5-64FF-4387-9418-F1D67AFB2247} (MaxisSuperstarTeleX Control) - http://thesims.ea.co...erstarTeleX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1097255851781
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamesp...nch/alaunch.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab34246.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/z...s/heartbeat.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{66CB01A5-D6C0-4FA0-AED4-D555180E2CE0}: NameServer = 196.43.1.11 196.25.1.11
O17 - HKLM\System\CCS\Services\Tcpip\..\{B835A8CE-B22A-400F-A174-4BE12EC019A7}: NameServer = 192.168.10.200,196.25.84.195
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
  • 0

Advertisements

#2
Rawe
Posted 17 July 2005 - 10:08 AM

Rawe

    Visiting Staff

  • Member
  • PipPipPipPipPipPipPip
  • 4,746 posts
Your HJT log shows only one object which needs to fixed and it's this;
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamesp...nch/alaunch.cab

I did edit my previous reply to you. You don't certainly have CoolWebSearch.
I'd be quite concerned about my SpyBot if it would show something like that :tazz:

Is it the latest version with the latest updates?
  • 0

#3
Dark_Side
Posted 17 July 2005 - 10:15 AM

Dark_Side

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 303 posts
Yes. the very latest. I'm farely dissapointed in Spybot now, since my HJT log is clean and it tells me I have CWS.
  • 0

#4
Rawe
Posted 17 July 2005 - 10:18 AM

Rawe

    Visiting Staff

  • Member
  • PipPipPipPipPipPipPip
  • 4,746 posts
If you are telling the truth and it shows you that, just go ahead and post to this forum about false positives;
http://forums.net-in...dex.php?act=idx :tazz:

Let the SpyBot experts determine that.

For me it has never given false positives.
  • 0

#5
Dark_Side
Posted 17 July 2005 - 11:13 AM

Dark_Side

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 303 posts
the link is dead.
  • 0

#6
Rawe
Posted 17 July 2005 - 11:14 AM

Rawe

    Visiting Staff

  • Member
  • PipPipPipPipPipPipPip
  • 4,746 posts
http://forums.net-in...n.net/index.php?
  • 0

#7
Guest_usetobe_*
Posted 17 July 2005 - 11:15 AM

Guest_usetobe_*
  • Guest
Does it give a location for them.....are they just orphaned registry entries?
  • 0

#8
Dark_Side
Posted 17 July 2005 - 11:20 AM

Dark_Side

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 303 posts
Yeah. Most locations are in the Hkey_Local_Machine. Not sure what that means.
  • 0

#9
Guest_usetobe_*
Posted 17 July 2005 - 11:34 AM

Guest_usetobe_*
  • Guest
As i just said they will be orphaned registery entries. Without the associated files they are no danger, you can however delete them from the registery, just follow the filepaths in regedit
  • 0

#10
Dark_Side
Posted 17 July 2005 - 11:38 AM

Dark_Side

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 303 posts
This is all fine and dandy but my HJT log is clean and Spybot detects faulty malware. This is the problem.
  • 0

#11
Guest_usetobe_*
Posted 17 July 2005 - 11:57 AM

Guest_usetobe_*
  • Guest
For all intent and purposes your HJT log is clean. Different detection products DO detect different things. That does not mean that your pc is in any danger, as i have said they will be orphaned entries in your regisery that do not pose any harm, however if they concern you, remove them using regedit.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP