Hijackthis log....please review

metomeyametomeya New
edited April 2004 in Spyware & Virus Removal
Hey,

I'm cleaning my mom's computer of spyware and adware since shes had a virus attack. My brother and I goto websites and use kazaa on this computer (blew my cpu out on mine) which probably causes all this stuff.

Anways i've ran Adaware , Spywareblaster , and CWShredder as well as a internet Macafe Virus Scan and a virus scan on our computer. I updated them all too before scanning.

However I believe i still have spy ware on my computer, cause we have about 40 servirce processes running. So I ran Hijackthis and got a log, can anyone look at it and tell me what i need to get rid of?

---Two notes on fixing this computer I can't startup in safe mode cause my mom believes doing so ruined our last computer (shes standing over my shoulder as i type this) and we only use MSN explorer (yes I know its evil and hard to work with) and thats the only thing my mom wants to use and I know it uses alots of the what seemed to be unnecessary internet services to work.



Start of Log
Logfile of HijackThis v1.97.7
Scan saved at 9:18:56 AM, on 4/23/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Caere\OmniPagePro90\opware32.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\kdx\KHost.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\cidaemon.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\Program Files\MSN\MSNIA\msniasvc.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9022
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.sony.com/vaiopeople
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_3_12_0.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1601.0\en-us\msntb.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_3_12_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ZTgServerSwitch] "c:\program files\support.com\client\lserver\server.vbs"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE NvQTwk,NvCplDaemon initialize"
O4 - HKLM\..\Run: [OmniPage] "C:\Program Files\Caere\OmniPagePro90\opware32.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min
O4 - HKLM\..\Run: [kdx] C:\WINDOWS\kdx\KHost.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - https://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/patch/EARTPX.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/12ba085eb93f566a6000/netzip/RdxIE601.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38099.8056944444
O16 - DPF: {BB47CA33-8B4D-11D0-9511-00C04FD9152D} (ExteriorSurround Object) - http://autos.msn.com/components/ocx/exterior/Outside.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/patch/MaxisSimCity4PatcherX.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DC765522-D5BE-49C9-AF5F-8C715A44BA28} (MS Investor Ticker) - http://fdl.msn.com/public/investor/v9.5/ticker.cab
O16 - DPF: {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} (CTAdjust Class) - http://download.microsoft.com/download/7/E/6/7E6A8567-DFE4-4624-87C3-163549BE2704/clearadj.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4351/mcfscan.cab
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://content.kontiki.com/kdx/v2.11/kontiki/kontiki/current/kdx.cab
O16 - DPF: {FF054BED-D972-4215-897E-726C3488DDBB} (sonyctl.sonycm) - http://supportcentral4.sel.sony.com/sdccommon/download/sonyctl.CAB
End of Log

Thanks ya'll

Comments

  • DexterDexter Vancouver, BC Canada
    edited April 2004
    For starters, tell your Mom that there is no possible way for Safe Mode to ruin anything. It's called "Safe Mode" for a reason. If it was dangerous, they would have called it "Dangerous Mode." ;)

    Let Mom read this:

    http://computer.howstuffworks.com/question575.htm
    There are several things that happen when Windows boots in Safe Mode that differ from a standard boot:


    Safe Mode does not run the autoexec.bat or config.sys files.

    Most device drivers are not loaded. A device driver is the software that Windows uses to interact with a piece of hardware, such as a printer or scanner.

    Instead of the normal graphics device driver, Safe Mode uses standard VGA graphics mode. This mode is supported by all Windows-compatible video cards.

    Himem.sys, which is normally loaded as part of the config.sys script, is loaded with the /testmem:on switch. This switch tells the computer to test the extended memory before continuing.

    Safe Mode checks the msdos.sys file for information on where to find the rest of the Windows files. If it finds the files, it proceeds to load Windows in Safe Mode with the command win /d:m. If it does not find the Windows files, it will run command.com to bring up a C: prompt.

    Windows boots using a batch file called system.cb instead of the standard system.ini file. This file loads the Virtual Device Drivers (VxDs) that Windows uses to communicate with the standard parts of the computer.

    Windows now loads the regular system.ini file plus win.ini and Registry settings. It skips the [Boot] (except for the shell and device lines) and [386Enh] sections of system.ini and does not load or run any programs listed in win.ini.

    The Windows desktop loads up in 16 colors and at a resolution of 640 x 480 with the words "Safe Mode" in each corner.

    What that basically means is that Windows load only the BARE MINIMUM of stuff to operate. This prevents malicious programs like viruses, or "crapware" like spyware or adware, from loading up at start. Some programs do not let you stop them or remove them once they are running, and SAFE MODE is the ONLY way to do this in most cases.

    Dexter...
  • DexterDexter Vancouver, BC Canada
    edited April 2004
    Okay, let's review your log.


    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9022

    Unless you are knowingly using a proxy server to access the internet, delete this. If you are not sure, check with your ISP to see if you need to be referencing 127.0.0.1:9022 as a Proxy Server.


    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.sony.com/vaiopeople

    This is setting your home page to Sony.com's Vaio page. You can delete this if you want and manually set your home page in your IE Tools menu.


    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_3_12_0.dll

    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_3_12_0.dll

    Yahoo toolbar. If you don't want it, delete them.


    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

    Leave this alone, it is your Acrobat plugin for viewing PDF pages inside your browser.

    O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1601.0\en-us\msntb.dll

    MSN toolbar. If you don't want it, delete it.


    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

    Windows Media toolbar. Leave it.


    O4 - HKLM\..\Run: [ZTgServerSwitch] "c:\program files\support.com\client\lserver\server.vbs"

    From my research, this one appears to be related to Sony VAIO laptops. The jury is sitll out on what it does...I did read an entry or two that suspects it is a form of browser tracking spyware. It is definitely not a necessary item, and I doubt it would hurt anything to remove it. Users's call, but I would toast it.


    O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE NvQTwk,NvCplDaemon initialize"

    NVidia graphics drivers. Don;t touch.

    O4 - HKLM\..\Run: [OmniPage] "C:\Program Files\Caere\OmniPagePro90\opware32.exe"

    Part of the Omniform software family. Leave it if someone uses Omniform.


    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

    Automatically checks for updates to the Real Player program. Waste of resources, as the player itself will also tell you if you need an update. Delete this.


    O4 - HKLM\..\Run: [AVGCtrl] C:\Program Files\AVPersonal\AVGNT.EXE /min

    Antivirus software. Leave it.

    O4 - HKLM\..\Run: [kdx] C:\WINDOWS\kdx\KHost.exe

    Kontiki media distribution app. Not needed, so unless someone specifically installed it, it is safe to delete. Some news websites use this as a back-channel for viewing online media.


    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    Same as for Realplayer, except that this is for Quicktime. You can toast this safely.

    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

    Again, an auto-updater. Just slowing down your startup routine. Toast.

    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl

    Autostart for AIM. NOt necessary, unless you really want AIM to start every time you start the computer, or are too lazy to start the app yourself :)

    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

    Same as above expect this is for MSN Messenger.

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

    Plugin for right-click contextual menu to export stuff to Excel. Safe to leave.

    O9 - Extra button: AIM (HKLM)

    O9 - Extra button: Real.com (HKLM)

    O9 - Extra button: Messenger (HKLM)

    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)

    These add buttons to Explorer to launch those apps. Not needed, but not harmful.



    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

    O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll

    Part of Acrobat software. Leave these.


    O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople

    Resets defualt homepage to Sony Vaio. Toast if unwanted.


    All the rest of those are "DPF's" - Downloaded Program Files. These are files in yoru Internet temporary files folder that you have downloaded at one time or another as "helper" programs or plugins. Most of these are safe to keep. In your case specifcally, they are all safe, nothing bad here.

    Your Mom has a pretty clean computer. Toasting the items I mentioned will speed up the boot process and free up some RAM.

    Tell Mom that in lieu of a bill for my services, she can buy me a Short-Media t-shirt and send it to me :)

    Cheers,

    Dexter...
  • TheBaronTheBaron Austin, TX
    edited April 2004
    that was extremely thorough dexter
This discussion has been closed.