Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

free6.se removal

Started by btucker1970 , Jan 11 2005 06:57 AM

  • Please log in to reply

#1
btucker1970
Posted 11 January 2005 - 06:57 AM

btucker1970

    New Member

  • Member
  • Pip
  • 3 posts
Another free6.se nuisance for your help - log below:

Logfile of HijackThis v1.99.0
Scan saved at 13:53:06, on 11.01.2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\SAFEGUARD\SGEASY\SGECTL.EXE
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\Ati2evxx.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\WINNT\System32\cisvc.exe
C:\WINNT\MS\SMS\CORE\BIN\CLISVCL.EXE
C:\Program Files\Cisco Systems\BT Secure Remote Access 4.0.3\cvpnd.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\MsgSys.EXE
C:\WINNT\MS\SMS\clicomp\apa\Bin\smsapm32.exe
C:\WINNT\Explorer.EXE
C:\WINNT\Syngenta\SAHARA\TOOLS\IPSTATE.EXE
C:\Program Files\NavNT\vptray.exe
C:\WINNT\system32\atiptaxx.exe
C:\WINNT\System32\WBEM\unsecapp.exe
C:\WINNT\system32\ltmsg.exe
C:\Program Files\Compaq\Hotkey Software\hkss.exe
C:\WINNT\system32\PRPCUI.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINNT\MS\SMS\CORE\BIN\LAUNCH32.EXE
C:\SAFEGUARD\SGEASY\ECVIEW.EXE
C:\WINNT\MS\SMS\CLICOMP\SWDist32\bin\smsmon32.exe
C:\PROGRA~1\ahead\InCD\InCD.exe
C:\Program Files\IS News\IS-News.exe
C:\Program Files\ZyXEL\ADSL USB Modem\CnxDslTb.exe
C:\WINNT\system32\ntvdm.exe
C:\Program Files\Babylon\Babylon.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\WINNT\System32\cidaemon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Documents and Settings\tuckebe1\Local Settings\Temporary Internet Files\Content.IE5\5EWZK33Q\HijackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search1.pro.intra/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search1.pro.intra/search/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://syngenta.intra/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://search1.pro.intra/search/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search1.pro.intra/search/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search1.pro.intra/search/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://syngenta.intra
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Syngenta
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://webproxy/admin/isa.pac
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-7173706D1316} - C:\WINNT\system32\spm1316.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IPStateChangeUtil] %SYNROOT%\SAHARA\TOOLS\IPSTATE.EXE
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [hkss] C:\Program Files\Compaq\Hotkey Software\hkss.exe
O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [SMS Application Launcher] C:\WINNT\MS\SMS\CORE\BIN\LAUNCH32.EXE
O4 - HKLM\..\Run: [My Documents Fix] C:\WINNT\SYNGENTA\SAHARA\TOOLS\HOMEFIX.KIX
O4 - HKLM\..\Run: [EDWizard] C:\SAFEGUARD\SGEASY\EDWIZARD.EXE as
O4 - HKLM\..\Run: [SgeEcView] C:\SAFEGUARD\SGEASY\ECVIEW.EXE
O4 - HKLM\..\Run: [InCD] C:\PROGRA~1\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [IS News] %ProgramFiles%\IS News\IS-News.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\ZyXEL\ADSL USB Modem\CnxDslTb.exe"
O4 - HKLM\..\Run: [Outlook Patch] C:\WINNT\OutlookPersFBackupPatch.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AssetMgmtScript] wscript //B //Nologo C:\WINNT\SYNGENTA\SAHARA\TOOLS\assetmgmt.vbs
O4 - HKLM\..\Run: [Babylon Client] D:\Documents and Settings\All Users\Start Menu\Programs\Babylon.lnk
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O15 - Trusted Zone: *.cc-chemplorer.com
O15 - Trusted Zone: *.perfect.com
O16 - DPF: Documentum Content Transfer Applets -
O16 - DPF: {B1D475FE-75CD-11D2-8301-0060B0B32E16} (ImpPKCS12 Class) - https://enigma.app.intra/vsimport.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = EAME.SYNGENTA.ORG
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = EAME.SYNGENTA.ORG
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = EAME.SYNGENTA.ORG
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINNT\system32\vbsys2 (file missing)
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: pcAnywhere Host Service - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Cisco Systems, Inc. VPN Service - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\BT Secure Remote Access 4.0.3\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Norton AntiVirus Client - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: OracleHome0ClientCache - Unknown - C:\Program Files\Oracle\ora81\bin\ONRSD.EXE
O23 - Service: OracleHome1ClientCache80 - Unknown - C:\Program Files\Oracle\dev6i\BIN\ONRSD80.EXE
O23 - Service: SgeCtl - Utimaco Safeware AG - C:\SAFEGUARD\SGEASY\SGECTL.EXE

Help greatfully appreciated.

BJT
  • 0

Advertisements

#2
Metallica
Posted 11 January 2005 - 07:43 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Check the following items in HijackThis.
Close all windows except HijackThis and click Fix checked:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search1.pro.intra/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search1.pro.intra/search/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://search1.pro.intra/search/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search1.pro.intra/search/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search1.pro.intra/search/

O2 - BHO: Cls - {CF021F40-3E14-23A5-CBA2-7173706D1316} - C:\WINNT\system32\spm1316.dll

O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINNT\system32\vbsys2 (file missing)

Download CWShredder from http://www.intermute...r_download.html
Use the Fix button.

Then reboot and post a new log.
Also tell me if this software is indeed installed on that computer:
SafeGuard

Regards,

Pieter
  • 0

#3
btucker1970
Posted 12 January 2005 - 03:19 AM

btucker1970

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
Dear Pieter,

Many thanks for the quick response.

I followed your instructions and encountered an error when running the Fix in Hikack This for line O21 as follows:

An unexpected error has occurred at procedure: modBackup_MakeBackup(sItem=O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINNT\system32\vbsys2 (file missing))
Error #62 - Input past end of file

Please email me at [email protected], reporting the following:
* What you were doing when the error occurred
* How you can reproduce the error
* A complete HijackThis scan log, if possible

Windows version: Windows NT 5.00.2195
MSIE version: 6.0.2800.1106
HijackThis version: 1.99.0

This message has been copied to your clipboard.

I sent this error message to the e-mail address as requested.

The remainder of the process went smoothly and the Hijack This log is now as follows:

Logfile of HijackThis v1.99.0
Scan saved at 10:13:49, on 12.01.2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\SAFEGUARD\SGEASY\SGECTL.EXE
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\Ati2evxx.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\WINNT\System32\cisvc.exe
C:\WINNT\MS\SMS\CORE\BIN\CLISVCL.EXE
C:\Program Files\Cisco Systems\BT Secure Remote Access 4.0.3\cvpnd.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\UPHClean\uphclean.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\MS\SMS\clicomp\apa\Bin\smsapm32.exe
C:\WINNT\system32\MsgSys.EXE
C:\WINNT\Explorer.EXE
C:\WINNT\Syngenta\SAHARA\TOOLS\IPSTATE.EXE
C:\Program Files\NavNT\vptray.exe
C:\WINNT\system32\atiptaxx.exe
C:\WINNT\system32\ltmsg.exe
C:\WINNT\System32\WBEM\unsecapp.exe
C:\Program Files\Compaq\Hotkey Software\hkss.exe
C:\WINNT\system32\PRPCUI.exe
C:\Program Files\Compaq\EAB\EabServr.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINNT\MS\SMS\CORE\BIN\LAUNCH32.EXE
C:\SAFEGUARD\SGEASY\ECVIEW.EXE
C:\WINNT\MS\SMS\CLICOMP\SWDist32\bin\smsmon32.exe
C:\PROGRA~1\ahead\InCD\InCD.exe
C:\Program Files\IS News\IS-News.exe
C:\Program Files\ZyXEL\ADSL USB Modem\CnxDslTb.exe
C:\WINNT\system32\ntvdm.exe
C:\Program Files\Babylon\Babylon.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\WINNT\System32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://syngenta.intra/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://syngenta.intra
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Syngenta
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://webproxy/admin/isa.pac
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IPStateChangeUtil] %SYNROOT%\SAHARA\TOOLS\IPSTATE.EXE
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [LTWinModem1] ltmsg.exe 9
O4 - HKLM\..\Run: [hkss] C:\Program Files\Compaq\Hotkey Software\hkss.exe
O4 - HKLM\..\Run: [PRPCMonitor] PRPCUI.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\Compaq\EAB\EabServr.exe /Start
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [SMS Application Launcher] C:\WINNT\MS\SMS\CORE\BIN\LAUNCH32.EXE
O4 - HKLM\..\Run: [My Documents Fix] C:\WINNT\SYNGENTA\SAHARA\TOOLS\HOMEFIX.KIX
O4 - HKLM\..\Run: [EDWizard] C:\SAFEGUARD\SGEASY\EDWIZARD.EXE as
O4 - HKLM\..\Run: [SgeEcView] C:\SAFEGUARD\SGEASY\ECVIEW.EXE
O4 - HKLM\..\Run: [InCD] C:\PROGRA~1\ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [IS News] %ProgramFiles%\IS News\IS-News.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\ZyXEL\ADSL USB Modem\CnxDslTb.exe"
O4 - HKLM\..\Run: [Outlook Patch] C:\WINNT\OutlookPersFBackupPatch.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AssetMgmtScript] wscript //B //Nologo C:\WINNT\SYNGENTA\SAHARA\TOOLS\assetmgmt.vbs
O4 - HKLM\..\Run: [Babylon Client] D:\Documents and Settings\All Users\Start Menu\Programs\Babylon.lnk
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O15 - Trusted Zone: *.cc-chemplorer.com
O15 - Trusted Zone: *.perfect.com
O16 - DPF: Documentum Content Transfer Applets -
O16 - DPF: {B1D475FE-75CD-11D2-8301-0060B0B32E16} (ImpPKCS12 Class) - https://enigma.app.intra/vsimport.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = EAME.SYNGENTA.ORG
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = EAME.SYNGENTA.ORG
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = EAME.SYNGENTA.ORG
O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: pcAnywhere Host Service - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Cisco Systems, Inc. VPN Service - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\BT Secure Remote Access 4.0.3\cvpnd.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Norton AntiVirus Client - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: OracleHome0ClientCache - Unknown - C:\Program Files\Oracle\ora81\bin\ONRSD.EXE
O23 - Service: OracleHome1ClientCache80 - Unknown - C:\Program Files\Oracle\dev6i\BIN\ONRSD80.EXE
O23 - Service: SgeCtl - Utimaco Safeware AG - C:\SAFEGUARD\SGEASY\SGECTL.EXE

I can also confirm that this computer is running Safeguard.

Thanks again

BJT
  • 0

#4
Metallica
Posted 12 January 2005 - 08:43 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Excellent job. :tazz:

Looks like you nailed it.

Any more problems left to deal with?

Regards,

Pieter
  • 0

#5
btucker1970
Posted 12 January 2005 - 08:52 AM

btucker1970

    New Member

  • Topic Starter
  • Member
  • Pip
  • 3 posts
Pieter,

Everything seems fine - I have also seen a marked improvement in the speed of my computer as well - a really good additional benefit.

Many thanks again.

BJT
  • 0

#6
Metallica
Posted 12 January 2005 - 09:04 AM

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 33,101 posts
Good to hear. Glad we could help. :tazz:

Safe surfing,

Pieter
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP