HJT log :/

IbanezIbanez
edited June 2004 in Spyware & Virus Removal
Hello everyone :) Nice to see such a big forum with lots of help :) I was wondering if someone would be willing to help me.. I keep gettin this Hotxxx pop up ... which when im in game it disconnects me and trys to dial up. I have uninstalled it about 50times but it wont go away ... some days it comes up once ... then other days it comes up no stop and it has started to do my head in as u can imagin! I have done a HJT log maybe someone could look at that and see if there is something mentaly wrong on it :)


Logfile of HijackThis v1.97.7
Scan saved at 11:20:31 PM, on 6/23/2004
Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
C:\WINNT\Explorer.exe
C:\WINNT\System32\RunDll32.exe
C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe
C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\WINNT\System32\dslagent.exe
C:\WINNT\loadqm.exe
C:\WINNT\System32\RUNDLL32.EXE
C:\WINNT\System32\WF2K.EXE
C:\WINNT\s_menu.exe
C:\Program Files\Trend Micro\PC-cillin 2002\WebTrap.EXE
C:\Program Files\IRC\mirc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\James\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.overclockers.co.uk/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.btbroadbandstart.com/
O2 - BHO: (no name) - {5FA6752A-C4A0-4222-88C2-928AE5AB4966} - C:\WINNT\System32\SWin32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [Adstartup] C:\WINNT\System32\automove.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinFoxV2] C:\WINNT\System32\WF2K.EXE Initial
O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings
O4 - HKLM\..\Run: [StartMenu] C:\WINNT\s_menu.exe /i
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {11111111-1111-1111-1111-111111111123} - file://c:\Recycled\1.exe
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/091a30b768c8bcb1c205/netzip/RdxIE601.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38152.2783912037
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by16fd.bay16.hotmail.msn.com/activex/HMAtchmt.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{2668FC1B-2A78-4EA4-8C74-CBD84231ADDF}: NameServer = 194.72.9.34 194.74.65.68
O17 - HKLM\System\CS1\Services\Tcpip\..\{2668FC1B-2A78-4EA4-8C74-CBD84231ADDF}: NameServer = 194.72.9.34 194.74.65.68



Thnx for your time, and i hope someone out there can help :)
From James :Rocker:

Comments

  • vanagon40vanagon40 Indiana Member
    edited June 2004
    First things first.

    Please move HJT off the desktop and into its own folder. When fixing things with HJT, a backup is made which can easily get lost on the desktop.

    Then, in the safe mode, run HJT to remove ("fix") these entries:

    O2 - BHO: (no name) - {5FA6752A-C4A0-4222-88C2-928AE5AB4966} - C:\WINNT\System32\SWin32.dll

    O4 - HKLM\..\Run: [Adstartup] C:\WINNT\System32\automove.exe

    Then delete these files if they still exist

    C:\WINNT\System32\SWin32.dll
    C:\WINNT\System32\automove.exe

    Reboot normal mode.

    Run AdAware and Spybot S&D (with latest updates) and the post new HJT log.
  • Straight_ManStraight_Man Geeky, in my own way Naples, FL Icrontian
    edited June 2004
    James, for this one I would run SpyBot S&D 1.3 and get it definition updated on the web (It knows where to go to get updates, and has three or four choices, I use SecurityWonks choice for download from US just fine, just updated mine on the XP box here while doublechecking use details for SpyBot 1.3 by looking at SpyBot). Run it in advanced mode, while in Windows SAFE MODE. It handles XXX (porn) feeding and linking bots and trojans among other things.
    AdAware can also help maybe. If you cannot find a place to go to fetch them, go to main page at http://www.short-media.com/ and look for a downloads entry in nav pane. once looking at category list, choose Security (yes, Short-Media has them here for download). You can also download these from C|Net's Download.com, and for a slow DSL or dialup connect Download.com is very tolerant as it can handle that slow connect FTP reliably. It's also faster for AdAware and SpyBot downloads in US than the author's overseas websites.

    I have had runs of BOTH (not at once, one after the other) work where either failed, and I see very little to obviously delete in this log. SpyBot will also let you kill tracking cookies, and DataMiner cookies, porn email and porn sites often install and\or use those also. Run it in Advanced mode to get it to tell you about those and offer to kill them.

    What I would find useful is to see what happens with the HJT log after both those programs are run. At that time I or one of the SWAT type folks will look deeper into things in log, but this log tells me cookies are probably large part of cause, or trojans or bots. Mostly because the log has very little that is an obvious trojan file at a quick look.

    The one thing I do see in the log that is a bit much is the TWO 17 entries for DNS servers. Most systems need only one copy of this entry at most. You could kill ONE of these if you do not have two connects to the same service foir Internet. If you no longer have a USB modem to hook to DSL, there are other things that can go also and killing them can save your box some un-needed running of things. This last would be more in the nature of performance tuning, lets get rid of the porn junk first. OK????
  • IbanezIbanez
    edited June 2004
    :wave:
    Hey thnx for all the help so far ... i have re installed HJT into its own folder .. I then deleted the lines and rebooted my pc ... then i started adware and spybot ... and now i have a new HTJ file for you to look at :) here it is:

    Logfile of HijackThis v1.97.7
    Scan saved at 2:57:06 AM, on 6/24/2004
    Platform: Windows 2000 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\System32\nvsvc32.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\Program Files\Trend Micro\PC-cillin 2002\PCCPFW.exe
    C:\WINNT\Explorer.exe
    C:\WINNT\System32\RunDll32.exe
    C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe
    C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe
    C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe
    C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
    C:\WINNT\System32\dslagent.exe
    C:\WINNT\loadqm.exe
    C:\WINNT\System32\RUNDLL32.EXE
    C:\WINNT\System32\WF2K.EXE
    C:\WINNT\s_menu.exe
    C:\Program Files\Trend Micro\PC-cillin 2002\WebTrap.EXE
    C:\Documents and Settings\James\My Documents\HJT\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.overclockers.co.uk/
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.btbroadbandstart.com/
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe"
    O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe"
    O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe"
    O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
    O4 - HKLM\..\Run: [GSICONEXE] gsicon.exe
    O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [WinFoxV2] C:\WINNT\System32\WF2K.EXE Initial
    O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings
    O4 - HKLM\..\Run: [StartMenu] C:\WINNT\s_menu.exe /i
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {11111111-1111-1111-1111-111111111123} - file://c:\Recycled\1.exe
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/091a30b768c8bcb1c205/netzip/RdxIE601.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38152.2783912037
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by16fd.bay16.hotmail.msn.com/activex/HMAtchmt.ocx
    O17 - HKLM\System\CCS\Services\Tcpip\..\{2668FC1B-2A78-4EA4-8C74-CBD84231ADDF}: NameServer = 194.72.9.34 194.74.65.68
    O17 - HKLM\System\CS1\Services\Tcpip\..\{2668FC1B-2A78-4EA4-8C74-CBD84231ADDF}: NameServer = 194.72.9.34 194.74.65.68



    No annoying pop ups yet ... but i also have another thing that happens, When i click on a web link or click IE, for some reason insted of opening IE fully it opens it but its minimized on the screen like 2cm wide 2cm high and it just bugs me that i have to click maximize everytime! Just wondering if there is a way to make it open full screen from the start? If you would like a screen dump i will post it.

    Thnx again for your help :) If the pop up comes back i will inform you people ... You obviously know what your doing, and im glad to have some support like you on the net! :respect:
  • IbanezIbanez
    edited June 2004
    :banghead: Ok not happy .... it only seems to pop up when im on Asherons Call 2!?! This is getting very annoying now! I dunno how it got on my pc in the first place! Grrr ... i will download windows updates i guess
Sign In or Register to comment.