This topic is locked
What should i do ?
Here is my HijackThis log:
Logfile of HijackThis v1.98.1
Scan saved at 10:45:34, on 23.2.2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\PROGRA~1\NORTON~2\NORTON~4\GHOSTS~2.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\Program Files\Eset\nod32krn.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\WINNT\Explorer.EXE
C:\WINNT\system32\regsvc.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\WINNT\system32\MSTask.exe
C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\Program Files\Eset\nod32kui.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\AdTools Service\AdTools.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\AdTools Service\AdToolsKeep.exe
C:\WINNT\System32\gah95on6.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\internat.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\WINNT\System32\mspmspsv.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\UFDisk\UFDisk Format Tool\iFormat.exe
C:\uros\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.web--search.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *hot-searches.com*;*lender-search.com*
R3 - URLSearchHook: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:\WINNT\Downloaded Program Files\webdlg32.dll
N3 - Netscape 7: user_pref("browser.startup.homepage", "www.24ur.com"); (C:\Documents and Settings\Pecar Vincenc\Application Data\Mozilla\Profiles\default\fgwtvsyl.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://D%3A%5Cnetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Pecar Vincenc\Application Data\Mozilla\Profiles\default\fgwtvsyl.slt\prefs.js)
O1 - Hosts file is located at: C:\WINNT\nsdb\hosts
O1 - Hosts: 82.179.166.164 lender-search.com
O1 - Hosts: 82.179.166.165 hot-searches.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - C:\WINNT\Downloaded Program Files\webdlg32.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: Search Bar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\WINNT\Downloaded Program Files\webdlg32.dll
O4 - HKLM\..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe /WAITSERVICE
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINNT\System32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AttuneClientEngine] C:\PROGRA~1\Aveo\Attune\bin\attune_ce.exe
O4 - HKLM\..\Run: [AdTools Service] C:\Program Files\AdTools Service\AdTools.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINNT\System32\gah95on6.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [sqlstr] C:\WINNT\System32\sqlstr.exe
O4 - HKCU\..\Run: [vb6stkit] C:\WINNT\System32\vb6stkit.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
O4 - Global Startup: Picture Package Menu.lnk = C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
O4 - Global Startup: iFormat.lnk = C:\Program Files\UFDisk\UFDisk Format Tool\iFormat.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0A4BE3F9-D407-4534-987E-E7132B281F2E} (Piezzo ActiveX) - http://www.ex-co.be/ex-co/Piezzo.cab
O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:\foo.mht!http://82.179.166.13....chm::/file.exe
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup...bridge-c382.cab
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9E8D2FA1-591C-11D0-BF52-0020AF32BD64} (Borland Midas DSBase 1) - http://www.ex-co.be/ex-co/Midas.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX/zd/kdx.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4FE4B7F1-FAB5-453A-A138-FE25349AB1BE}: NameServer = 216.35.46.54,213.197.128.100
O17 - HKLM\System\CCS\Services\Tcpip\..\{50958C07-AAB0-459A-87AA-FDBD6EFC756A}: NameServer = 212.18.32.12,193.2.1.66
O17 - HKLM\System\CCS\Services\Tcpip\..\{BA3A81B4-CF0C-4D28-9FB2-DA8C7283809B}: NameServer = 216.35.46.6,213.197.128.100
O17 - HKLM\System\CS1\Services\Tcpip\..\{4FE4B7F1-FAB5-453A-A138-FE25349AB1BE}: NameServer = 216.35.46.54,213.197.128.100
O17 - HKLM\System\CS2\Services\Tcpip\..\{4FE4B7F1-FAB5-453A-A138-FE25349AB1BE}: NameServer = 216.35.46.54,213.197.128.100
O20 - AppInit_DLLs: PAVWAIT.DLL
Sign In
Create Account
