Options

Hijack This - log

Unknown
edited May 2004 in Spyware & Virus Removal
Hello!

Thank ypu, thank you, for giving me the chance to get rid of (hopefully)this annoying pest of a problem!

Can you plz check my log to se if it`s all in the clear??

Logfile of HijackThis v1.97.7
Scan saved at 14:54:03, on 27.05.2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~2\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\CTSvcCDA.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\mdm.exe
C:\WINDOWS\System32\cidaemon.exe
C:\Documents and Settings\Eirin\Desktop\Hijack This\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.no/0SENONO/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startkanalen.no/index.html
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {A77B2AD9-F7F9-C6CE-937F-7262645C2D7E} - C:\PROGRA~2\SITEGL~1\Barb else.dll
O2 - BHO: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\RunServices: [Microsoft DirectX] wuamgrd.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Dagbladet (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O9 - Extra button: Epost (HKCU)
O9 - Extra button: Nyheter (HKCU)
O9 - Extra button: Start (HKCU)
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab
O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://download.microsoft.com/download/0/5/c/05c905f4-dd30-427d-a3de-373c3e5552fc/msSecAdv.cab?1084351904640
O16 - DPF: {3D2CB570-D425-11D5-ABD0-00008369C46F} (CSMenu Class) - https://nettbank.fokus.no/html/activex/FOK/Menu.cab
O16 - DPF: {40289096-9F72-4A04-BCB3-E434ECDCEE33} (AppDLCtrl Class) - http://download.howudodat.com/chatterbox/download/appdl.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.2) - http://web.bingonova.com/java/javaautodl.php
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/Sasser/20/SassCln.CAB
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLHelper/version7/DLHelper.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://webolr3.microgaming.com/luckynugget/webolr/OCX/FlashAX.cab

Regards,
Homla ( sending happy thoughts from Norway) :Rocker:

Comments

  • shwaipshwaip bluffin' with my muffin Icrontian
    edited May 2004
    hi, you didn't post what your problem actually was, but...

    1)Put hijack this into a folder c:\hjt
    2)boot into safe mode
    3) remove these entries with hijackthis:
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.no/0SENONO/SAOS01
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startkanalen.no/index.html
    O2 - BHO: (no name) - {A77B2AD9-F7F9-C6CE-937F-7262645C2D7E} - C:\PROGRA~2\SITEGL~1\Barb else.dll
    O2 - BHO: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O4 - HKLM\..\RunServices: [Microsoft DirectX] wuamgrd.exe

    O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (WebHandler Class) - http://activex.microgaming.com/DLHe...n7/DLHelper.cab
    O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://webolr3.microgaming.com/luc...OCX/FlashAX.cab
    4) remove the folder c:\program~2\sitegl~1
    this is a folder where "program~2" means the second folder (alphabetically) that starts with "program" and sitegl~1 is a folder that starts with sitegl

    5)reboot

    6) download and install adaware and spybot S&D from here, make sure to update and run them regularly.

    http://www.short-media.com/download.php?dc=69
    Tweaking, Tuning and Handy Utilities - Security - Short-Media.com
  • KwitkoKwitko Sheriff of Banning (Retired) By the thing near the stuff Icrontian
    edited May 2004
    You don't have to delete these:
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.no/0SENONO/SAOS01
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startkanalen.no/index.html

    This one is related to the SDBot virus. Follow these removal instructions.
    O4 - HKLM\..\RunServices: [Microsoft DirectX] wuamgrd.exe

    I didn't see any memory-resident virus scanner on your system. Are you running without any antivirus? If so, I urge you to run one. Grisoft makes a good free AV program.
  • homla
    edited May 2004
    Hi,
    sorry - my problem is (or was) the omegasearch!
    And thanks for everything - all is clear in the atmosphere!

    Homla :Rocker:
Sign In or Register to comment.