Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

My HijackThis Log *Silent Runners Log added*


  • Please log in to reply

#1
Coren

Coren

    New Member

  • Member
  • Pip
  • 5 posts
Lately I've been getting errors all the time and my computer has been pretty slow. Especially Java has been messed up.

I've scanned with various programs including F-Secure, Ad-Aware, Spysweeper, Spybot S&D etc. before posting this log.


Logfile of HijackThis v1.99.1
Scan saved at 20:38:24, on 29.8.2005
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINTOOSA\SYSTEM\KERNEL32.DLL
C:\WINTOOSA\SYSTEM\MSGSRV32.EXE
C:\WINTOOSA\SYSTEM\MPREXE.EXE
C:\WINTOOSA\SYSTEM\mmtask.tsk
C:\WINTOOSA\SYSTEM\MSTASK.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\COMMON\FSMA32.EXE
C:\WINTOOSA\SYSTEM\KB891711\KB891711.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\COMMON\FSMB32.EXE
C:\WINTOOSA\EXPLORER.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\COMMON\FCH32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\BACKWEB\7681197\PROGRAM\FSBWSYS.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\BACKWEB\7681197\PROGRAM\F-SECURE AUTOMATIC UPDATE.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\COMMON\FNRB32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\COMMON\FAMEH32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\ANTI-VIRUS\FSGK32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\FWES\PROGRAM\FSDFWD.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\COMMON\FIH32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\ANTI-VIRUS\FSSM32.EXE
C:\WINTOOSA\TASKMON.EXE
C:\WINTOOSA\SYSTEM\SYSTRAY.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\ANTI-VIRUS\FSAV32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\COMMON\FSM32.EXE
C:\WINTOOSA\V38SHELL.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\FSGUI\FSGUIEXE.EXE
C:\WINTOOSA\SYSTEM\WMIEXE.EXE
C:\WINTOOSA\SYSTEM\DDHELP.EXE
D:\HJT\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://216.65.101.250/sbms/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://phnet.fi/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://216.65.101.250/sbms/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.phnet.fi:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
F1 - win.ini: run=hpfsched
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\OHJELMATIEDOSTOT\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINTOOSA\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINTOOSA\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINTOOSA\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Ohjelmatiedostot\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Ohjelmatiedostot\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINTOOSA\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [ASUSTweakEnable] C:\Ohjelmatiedostot\ASUS\Tweaking Utilities\atstart.exe
O4 - HKLM\..\Run: [ASUSKey] V38SHELL.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINTOOSA\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [F-Secure Management Agent] C:\Ohjelmatiedostot\F-Secure\Common\FSMA32.EXE
O4 - HKLM\..\RunServices: [KB891711] C:\WINTOOSA\SYSTEM\KB891711\KB891711.EXE
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Ohjelmatiedostot\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINTOOSA\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINTOOSA\SYSTEM\MSJAVA.DLL
O16 - DPF: {2DAE59A1-B355-4653-8D33-33A3A8F8C078} (MaxisVacationTeleX Control) - http://thesims.ea.co...cationTeleX.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://sc.communitie...t/msnchat45.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn...UC/MsnPUpld.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://www.ipswitch....tp_le/setup.exe
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots....SDownloader.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn...pDownloader.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {4063B398-3FC7-433E-B23B-0460CE7EDC27} (MaxisMakinMagicTeleX Control) - http://thesims.ea.co...nMagicTeleX.cab
O16 - DPF: ChatSpace Full Java Client 4.0.0.320 - http://irc.everywher...va/cfs40320.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_1_0_0_44.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab

Edited by Coren, 04 September 2005 - 09:23 AM.

  • 0

Advertisements


#2
coachwife6

coachwife6

    SuperStar

  • Retired Staff
  • 11,413 posts
Hi Coren. What is your native tongue? Some of these files look odd, but I'm thinking maybe it's because of language?
  • 0

#3
Coren

Coren

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts

Hi Coren. What is your native tongue? Some of these files look odd, but I'm thinking maybe it's because of language?

View Post


My native tongue is Finnish.

Ohjelmatiedostot = Program Files
  • 0

#4
coachwife6

coachwife6

    SuperStar

  • Retired Staff
  • 11,413 posts
You may wish to print out a copy of these instructions to follow while you complete this procedure.

Please Download CoolWebShredder, from http://www.geekstogo...=download&id=17 , Extract it & run the program. Click the Next Button & let it scan. Make sure you let it fix all CWS Remnants.

Please save Hijack This in a permanent folder (i.e. C:\HJT). This ensures backups are saved and accessible.

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://216.65.101.250/sbms/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://216.65.101.250/sbms/

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINTOOSA\SYSTEM\MSJAVA.DLL

Reboot and please Post a fresh Hijack This log.
  • 0

#5
Coren

Coren

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Everything done like you said.

Here's the new log



Logfile of HijackThis v1.99.1
Scan saved at 16:06:10, on 31.8.2005
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINTOOSA\SYSTEM\KERNEL32.DLL
C:\WINTOOSA\SYSTEM\MSGSRV32.EXE
C:\WINTOOSA\SYSTEM\MPREXE.EXE
C:\WINTOOSA\SYSTEM\mmtask.tsk
C:\WINTOOSA\SYSTEM\MSTASK.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\COMMON\FSMA32.EXE
C:\WINTOOSA\SYSTEM\KB891711\KB891711.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\COMMON\FSMB32.EXE
C:\WINTOOSA\EXPLORER.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\COMMON\FCH32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\BACKWEB\7681197\PROGRAM\FSBWSYS.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\BACKWEB\7681197\PROGRAM\F-SECURE AUTOMATIC UPDATE.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\COMMON\FNRB32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\COMMON\FAMEH32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\ANTI-VIRUS\FSGK32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\FWES\PROGRAM\FSDFWD.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\COMMON\FIH32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\ANTI-VIRUS\FSSM32.EXE
C:\WINTOOSA\TASKMON.EXE
C:\WINTOOSA\SYSTEM\SYSTRAY.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\ANTI-VIRUS\FSAV32.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\COMMON\FSM32.EXE
C:\WINTOOSA\V38SHELL.EXE
C:\OHJELMATIEDOSTOT\F-SECURE\FSGUI\FSGUIEXE.EXE
C:\WINTOOSA\SYSTEM\WMIEXE.EXE
D:\HJT\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://phnet.fi/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
F1 - win.ini: run=hpfsched
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\OHJELMATIEDOSTOT\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINTOOSA\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINTOOSA\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINTOOSA\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Ohjelmatiedostot\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Ohjelmatiedostot\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINTOOSA\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [ASUSTweakEnable] C:\Ohjelmatiedostot\ASUS\Tweaking Utilities\atstart.exe
O4 - HKLM\..\Run: [ASUSKey] V38SHELL.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINTOOSA\SYSTEM\mstask.exe
O4 - HKLM\..\RunServices: [F-Secure Management Agent] C:\Ohjelmatiedostot\F-Secure\Common\FSMA32.EXE
O4 - HKLM\..\RunServices: [KB891711] C:\WINTOOSA\SYSTEM\KB891711\KB891711.EXE
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Ohjelmatiedostot\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
O16 - DPF: {2DAE59A1-B355-4653-8D33-33A3A8F8C078} (MaxisVacationTeleX Control) - http://thesims.ea.co...cationTeleX.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://sc.communitie...t/msnchat45.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn...UC/MsnPUpld.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} - http://www.ipswitch....tp_le/setup.exe
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots....SDownloader.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - http://messenger.msn...pDownloader.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zon...nt.cab31267.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zon...kr.cab31267.cab
O16 - DPF: {4063B398-3FC7-433E-B23B-0460CE7EDC27} (MaxisMakinMagicTeleX Control) - http://thesims.ea.co...nMagicTeleX.cab
O16 - DPF: ChatSpace Full Java Client 4.0.0.320 - http://irc.everywher...va/cfs40320.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplane...DC_1_0_0_44.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
  • 0

#6
coachwife6

coachwife6

    SuperStar

  • Retired Staff
  • 11,413 posts
You may wish to print out a copy of these instructions to follow while you complete this procedure.

Please save Hijack This in a permanent folder (i.e. C:\HJT). This ensures backups are saved and accessible.

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.


R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit<<is this something you use? If not, put a check mark next to it.

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\OHJELMATIEDOSTOT\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL (file missing)


Reboot and let me know how it's going. If it's still not working, please do this:

* Please click this link to download Silent Runners.
* Save it to the desktop.
* Run Silent Runner's by doubleclicking the "Silent Runners" icon on your desktop.
* You will see a text file appear on the desktop - it's not done yet, just let it run (it won't appear to be doing anything!)
* Once you receive the prompt "All Done!", double-click on the new text file on the desktop and copy that entire log and paste it here.

*NOTE* If you receive any warning message about scripts, please choose to allow the script to run.
  • 0

#7
Coren

Coren

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Linkit = Links

I won't be fixing that yet. I think it's used, but I'm not completely sure.

EDIT: I just fixed O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\OHJELMATIEDOSTOT\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL (file missing)

My computer is now running much more smoothly, than it used to. I haven't got a single error yet (after rebooting and trying Java after the first fix I got one, but it hasn't happened again).

I'm not yet sure about, that Links-thing. What do you think?


Do you think I should download, that Silent Runners and scan with it, even if I'm not having problems? Or is it only, if I'm having problems?

EDIT: I didn't remove Links - atleast yet. I ran Silent Runners, however.

Here's the log, I got.


"Silent Runners.vbs", revision 40.1, http://www.silentrunners.org/
Operating System: Windows 98
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"Steam" = (empty string)

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"ScanRegistry" = "C:\WINTOOSA\scanregw.exe /autorun" [MS]
"TaskMonitor" = "C:\WINTOOSA\taskmon.exe" [MS]
"SystemTray" = "SysTray.Exe" [MS]
"LoadPowerProfile" = "Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" [MS]
"F-Secure Manager" = ""C:\Ohjelmatiedostot\F-Secure\Common\FSM32.EXE" /splash" ["F-Secure Corporation"]
"F-Secure TNB" = ""C:\Ohjelmatiedostot\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW" ["F-Secure Corporation"]
"QuickTime Task" = ""C:\WINTOOSA\SYSTEM\QTTASK.EXE" -atboottime" ["Apple Computer, Inc."]
"ASUSTweakEnable" = "C:\Ohjelmatiedostot\ASUS\Tweaking Utilities\atstart.exe" ["ASUSTeK Computer Inc."]
"ASUSKey" = "V38SHELL.EXE" [","]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\ {++}
"LoadPowerProfile" = "Rundll32.exe powrprof.dll,LoadCurrentPwrScheme" [MS]
"SchedulingAgent" = "C:\WINTOOSA\SYSTEM\mstask.exe" [MS]
"F-Secure Management Agent" = "C:\Ohjelmatiedostot\F-Secure\Common\FSMA32.EXE" ["F-Secure Corporation"]
"KB891711" = "C:\WINTOOSA\SYSTEM\KB891711\KB891711.EXE" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = "AcroIEHlprObj Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\OHJELMATIEDOSTOT\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL" [file not found]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{3c249f62-e26e-11d4-97f0-009027769c61}" = "Format Shell"
-> {CLSID}\InProcServer32\(Default) = "C:\WINTOOSA\SYSTEM\SMSHELL.DLL" ["OnSpec Electronic Inc.,"]
"{03FF3962-D823-11D4-97F0-009027769C61}" = "Data Caching Shell Extension"
-> {CLSID}\InProcServer32\(Default) = "C:\WINTOOSA\SYSTEM\FlashShl.dll" [" "]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "C:\OHJELM~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
TrojanHunter\(Default) = "{EBDF1F20-C829-11D1-8233-FF20AF3E97A9}"
-> {CLSID}\InProcServer32\(Default) = "C:\OHJELM~1\TROJAN~1.2\CONTMENU.DLL" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "C:\OHJELM~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
TrojanHunter\(Default) = "{EBDF1F20-C829-11D1-8233-FF20AF3E97A9}"
-> {CLSID}\InProcServer32\(Default) = "C:\OHJELM~1\TROJAN~1.2\CONTMENU.DLL" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinZip\(Default) = "{E0D79304-84BE-11CE-9641-444553540000}"
-> {CLSID}\InProcServer32\(Default) = "C:\OHJELM~1\WINZIP\WZSHLSTB.DLL" ["WinZip Computing, Inc."]
TrojanHunter\(Default) = "{EBDF1F20-C829-11D1-8233-FF20AF3E97A9}"
-> {CLSID}\InProcServer32\(Default) = "C:\OHJELM~1\TROJAN~1.2\CONTMENU.DLL" [null data]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINTOOSA\Webshots for Sampsa.bmp"


WIN.INI & SYSTEM.INI launch points:
-----------------------------------

WIN.INI
[windows]
INFECTION WARNING! "Run=hpfsched" [null data]


Startup items in "Startup" & "All Users...Startup" folders:
-----------------------------------------------------------

C:\WINTOOSA\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys
"F-Secure Automatic Update" -> shortcut to: "C:\Ohjelmatiedostot\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe -startup" [null data]


Enabled Scheduled Tasks:
------------------------

"SDMsgUpdate (SmartDrawTrial)" -> launches: "G:\SMARTDRAW\MESSAGES\SDNotify.exe -PSmartDrawTrial -V7 -SSDN.ini -A -T -N -L -X" [","]
"Säätötoiminnon aloitus" -> launches: "walign" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "C:\WINTOOSA\SYSTEM\rnr20.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
00000000000#\PackedCatalogItem (contains) DLL [Company Name], (at) # range:
C:\WINTOOSA\SYSTEM\mswsosp.dll [MS], 1
C:\WINTOOSA\SYSTEM\msafd.dll [MS], 2 - 4
C:\WINTOOSA\SYSTEM\rsvpsp.dll [MS], 5 - 6


Miscellaneous IE Hijack Points
------------------------------

HKLM\Software\Microsoft\Internet Explorer\Version = (invalid data)
The Internet Explorer version cannot be found!

C:\WINTOOSA\INF\IERESET.INF (used to "Reset Web Settings")
The contents of IERESET.INF cannot be reliably checked!

Added lines (compared with English-language version):
[Strings]: START_PAGE_URL="http://www.microsoft...r=6&ar=msnhome"
[Strings]: MS_START_PAGE_URL="http://www.microsoft...r=6&ar=msnhome"

Missing lines (compared with English-language version):
[Strings]: 2 lines

HKLM\Software\Microsoft\Internet Explorer\AboutURLs\
HIJACK WARNING! "blank " = "http://205.134.182.164/1/" [file not found]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
took 78 seconds.
+ The search for all Registry CLSIDs containing dormant Explorer Bars
took 15 seconds.
---------- (total run time: 106 seconds)

Edited by Coren, 04 September 2005 - 09:22 AM.

  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP