Help. Spyware on my computer

jaytajayta
edited June 2004 in Spyware & Virus Removal
Hello, I'm new here. Name's jayta.

I have been having trouble with a lot of spyware and adware. I've just run adware and spybot and got the hijack logfile. Could you take a look at this and tell me if there is anything left that I should be worried about. And if there is, how to deal with it. I am not computer inclined, so if you could do it in lamen's terms.

Also wondering something. I d/l a program Noadware. I have Adware, spybot and hijack this too. Do I need noadware?

This is much appreciated!

Logfile of HijackThis v1.97.7
Scan saved at 6:38:57 AM, on 15/06/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
C:\WINDOWS\SYSTEM32\USRmlnkA.exe
C:\WINDOWS\SYSTEM32\USRshutA.exe
C:\WINDOWS\SYSTEM32\USRmlnkA.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Norman\Desktop\HijackThis.exe

O2 - BHO: (no name) - {35A6E019-4754-386A-9AC1-589C2A2145EC} - C:\PROGRA~1\TEAMLI~1\Heckenc.dll
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\RealBar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\RealBar.dll
O3 - Toolbar: Dvdcool - {552A842B-86EE-7083-74B6-F45B3047320E} - C:\PROGRA~1\TEAMLI~1\Heckenc.dll
O4 - HKLM\..\Run: [] C:\WINDOWS\Options\OEMReset.exe /Audit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe

Comments

  • mmonninmmonnin Centreville, VA
    edited June 2004
    Hi Norman,

    First Put The HJT file into its own separate folder IE C:\HJT or C:\Program Files\HJT so backups wont go on your desktop.

    Then boot into safe mode, press F8 at when booting and select safe mode.

    Then remove these:
    O2 - BHO: (no name) - {35A6E019-4754-386A-9AC1-589C2A2145EC} - C:\PROGRA~1\TEAMLI~1\Heckenc.dll
    O3 - Toolbar: Dvdcool - {552A842B-86EE-7083-74B6-F45B3047320E} - C:\PROGRA~1\TEAMLI~1\Heckenc.dll

    Then go and delete the folder starting with TEAML in your program folders.

    For performance you can remove these as well but you dont ahve to:

    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
  • DexterDexter Vancouver, BC Canada
    edited June 2004
    Just a note regarding NeroCheck.exe. It is part of the Nero CD Burning application, it is not required if you Win2K/XP AND you have Administrator rights on the computer. However, if you have any users who login without admin privileges, you need to keep this on your system.

    Also, InCD, as mmonnin said, can be deleted from HJT, however, if you use the InCD packet writing software with CD-RW's, you need to manually launch InCD before trying to write to CD-RW.

    Also, unless you are really new to PC's, you can safely remove:

    O4 - HKLM\..\Run: [] C:\WINDOWS\Options\OEMReset.exe /Audit

    Dexter...
  • jaytajayta
    edited June 2004
    I can't seem to delete the Team License folder under Programs.

    Also, wondering when I put my computer into safe mode, where do I do the deletions? Do I go into hijack or any other ad/spyware or do I do it manually?
  • vanagon40vanagon40 Indiana Member
    edited June 2004
    jayta wrote:
    I can't seem to delete the Team License folder under Programs.

    Also, wondering when I put my computer into safe mode, where do I do the deletions? Do I go into hijack or any other ad/spyware or do I do it manually?

    First, make sure HiJack This (HJT) is in its own folder as suggested by mmonnin.

    Then remove these

    O2 - BHO: (no name) - {35A6E019-4754-386A-9AC1-589C2A2145EC} - C:\PROGRA~1\TEAMLI~1\Heckenc.dll
    O3 - Toolbar: Dvdcool - {552A842B-86EE-7083-74B6-F45B3047320E} - C:\PROGRA~1\TEAMLI~1\Heckenc.dll

    and optionally these:

    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe

    by running HJT, clicking next to the entries, and then click FIX

    By making sure HJT is in its own folder, a back-up will be created, in case a necessary item is inadvertantly deleted.

    Then manually delete the Team License folder. You should be able to delete it in the safe mode after running HJT. The reason it cannot be deleted now is that it contains a running program: Heckenc.dll

    After the items are "fixed," post a new HJT log.

    Good luck.
  • jaytajayta
    edited June 2004
    vanagon45 wrote:
    Then manually delete the Team License folder. You should be able to delete it in the safe mode after running HJT. The reason it cannot be deleted now is that it contains a running program: Heckenc.dll

    After the items are "fixed," post a new HJT log.

    Good luck.

    Okay, I've done everything up to this point. This is where I get confused.

    Where am I deleting the TeamL folder from? Do I do it in Start folder? Where I right click on the start button and enter the explore screen?

    Or do I do this somewhere else?

    Also, what do you mean 'items are fixed, post a new hjt log'?

    Do you mean post it here? Or am I supposed to post it somewhere in my computer?

    I'm not all that computer inclined. I know a few things, but sometimes I need things spelled out.

    I appreciate everyone's help! :Canflag:
  • vanagon40vanagon40 Indiana Member
    edited June 2004
    To delete the Team License folder:

    Reboot in safe mode

    From the Start menu, open "My computer"

    Double-click the "C" icon

    Double-Click the "program" folder

    You should see the Team License folder.

    Right click and choose "delete."

    Then close window and empty the recycle bin.

    (You can perform a simillar process using the Windows Explorer program from the Start menu.)

    Reboot normally.

    Then run HJT again and post the log here the same as you did in your first post. The second post is simply a double-check to make sure everything is gone and nothing else has appeared.
  • mmonninmmonnin Centreville, VA
    edited June 2004
    Yep follow what he said.^^^:)
  • jaytajayta
    edited June 2004
    Here is my new log...

    Logfile of HijackThis v1.97.7
    Scan saved at 6:51:40 PM, on 17/06/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
    C:\WINDOWS\SYSTEM32\USRmlnkA.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\BTV\btv.exe
    C:\WINDOWS\SYSTEM32\USRshutA.exe
    C:\WINDOWS\SYSTEM32\USRmlnkA.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Hijack This\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.ca/0SEENCA/SAOS01
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: (no name) - {63CF97E8-4133-438a-A831-CC9C6D47D673} - c:\Program Files\Reg2\Reg2.dll
    O2 - BHO: (no name) - {665ACD90-4541-4836-9FE4-062386BB8F05} - (no file)
    O2 - BHO: (no name) - {7371F073-AC0F-4b80-BB2F-96A488CEFB32} - c:\Program Files\Xmod\xm320.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
    O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Jreg] "C:\Program Files\Common Files\Java\Jreg2b.exe"
    O4 - HKLM\..\Run: [BTV] C:\Program Files\BTV\btv.exe
    O4 - HKLM\..\Run: [Breg] "C:\Program Files\Common Files\Java\breg.exe"
    O4 - HKCU\..\Run: [Morpheus] "C:\Program Files\StreamCast\Morpheus\Morpheus.exe" -min
    O4 - HKCU\..\Run: [schedsvc] C:\WINDOWS\System32\schedsvc.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [MessengerPlus3] "\" /WinStart
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/potc_x.cab
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {02CA9974-B6AC-497E-A371-73580432B0F6} (Eyeball Video Message Control) - http://ezcheating.com/ChatSource/hVideoContol.cab
    O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/SmileyCentralInitialSetup1.0.0.6.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/208ebb4b4097bd744603/netzip/RdxIE601.cab
    O16 - DPF: {5E943D9C-F8DC-4258-8E3F-A61BB3405A33} - http://www.imagestation.com/common/classes/batchdwnl.cab?version=4,3,2,20802
    O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.jwcinc.net/Cache/Include/XUpload.ocx
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
    O16 - DPF: {FF452CFC-7056-4A5D-A327-1DFEC8EDC82A} (Upload Class) - http://www.neptune.com/features/upload/ms40upld.ocx

    Oh wondering... I have been getting a pop up ad for spot on search browser, is there anyway to stop this from popping up all the time? I never used to have this problem....
  • jaytajayta
    edited June 2004
    Also need help on this problem I have been having since fixing all this stuff. Now my C drive keeps automatically opening whenever I log onto my computer. Why is that? And also spybot keeps disappearing on me...

    I think it may be because I somehow told it to go back to a certain day reboot...I don't know...it's all messed up...
Sign In or Register to comment.