Options

Another HijackThis log

Unknown
edited January 2005 in Spyware & Virus Removal
Ok, I've run Adware and Spybot, then HijackThis. I need help with which files to delete. Also, two questions about the HSA guide on short-media (comparing from other guides):

1) should I reboot if Adware and/or Spybot finds anything?
2) should I remove problem files when running HijackThis for the first time (not under the SAFE mode activation)?

Other guides suggested these two actions. thanks.

-Doug Geiger



Logfile of HijackThis v1.99.0
Scan saved at 4:30:10 PM, on 12/28/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
C:\WINDOWS\System32\hphmon03.exe
G:\Utilities\winpatrol.exe
C:\program files\captureeze97\capeze97.exe
C:\WINDOWS\System32\ctfmon.exe
G:\Utilities\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\System32\HPHipm09.exe
G:\Utilities\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.jpost.com/servlet/Satellite?pagename=JPost/P/DryBones&cid=1011177744908
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://shell.windows.com/fileassoc/0409/xml/redir.asp?Ext=?ÃA????
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
O2 - BHO: (no name) - {58D0CDED-292E-A742-0F1D-80D844764A6C} - C:\WINDOWS\ntny.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\System32\hphmon03.exe
O4 - HKLM\..\Run: [WinPatrol] G:\Utilities\winpatrol.exe
O4 - HKCU\..\Run: [CaptureEze97] c:\program files\captureeze97\capeze97.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] G:\Utilities\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: (HKLM)
O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} -
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe
O19 - User stylesheet: (file missing)
O23 - Service: AVSync Manager - Networks Associates Technologies, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
O23 - Service: IMAPI CD-Burning COM Service - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: McShield - Unknown - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\System32\HPHipm09.exe
O23 - Service: WAN Miniport (ATW) Service - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe (file missing)

Comments

  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited December 2004
    If either adaware or spybot find anything, reboot. Do not remove anything with hijackthis unless you intend fixing it yourself :). It makes it confusing to assess.

    Please download Service Filter

    Extract it to it's own folder.

    Double click on ServiceFilter.vbs. If your antivirus pops up, tell it to allow this script to run.

    A text file called POST_THIS will be in the same folder.

    Please post the contents of POST_THIS into this thread.

    Download this program.
    http://downloads.subratam.org/DllCompare.exe

    Now open DllCompare.exe and click the "Run Locate.com" button.
    Then click the "Compare" button (this will take a few minutes)
    When it finishes click the "Make Log...." button.
    save the log to desktop.

    Next copy and paste the contents of the DllCompare log in your
    reply along with a fresh HijackThis log.
  • douggeiger
    edited December 2004
    OK: here are the logs as you requested-

    Also, you might need to know that this browser hijack is on a dual-boot machine (Linux and Windows XP). That shouldn't make a difference, since I have not yet heard of a virus/hijack that can span OS systems/disk partitions. If however, this could be a problem, then maybe I should switch web browsers <g>. And when the hijack first occurred, the modem noise disappeared (but all the rest of the XP noises are there). Ok, on to the logs-
    >From Service Filter:
    The script did not recognize the services listed below.
    This does not mean that they are a problem.

    To copy the entire contents of this document for posting:
    At the top of this window click "Edit" then "Select All"
    Next click "Edit" again then "Copy"
    Now right click in the forum post box then click "Paste"

    ########################################

    ServiceFilter 1.1
    by rand1038

    Microsoft Windows XP Professional
    Version: 5.1.2600
    Dec 29, 2004 11:32:50 AM


    ---> Begin Service Listing <---

    Unknown Service # 1
    Service Name: AvSynMgr
    Display Name: AVSync Manager
    Start Mode: Auto
    Start Name: LocalSystem
    Description: McAfee AVSync ...
    Service Type: Own Process
    Path: "c:\program files\mcafee\mcafee virusscan\avsynmgr.exe"
    State: Running
    Process ID: 1380
    Started: True
    Exit Code: 0
    Accept Pause: False
    Accept Stop: True

    Unknown Service #2
    Service Name: ImapiService
    Display Name: IMAPI CD-Burning COM Service
    Start Mode: Manual
    Start Name: LocalSystem
    Description: Manages CD recording using Image Mastering Applications Programming Interface (IMAPI). If this ...
    Service Type: Own Process
    Path: c:\windows\system32\imapirox.exe
    State: Stopped
    Process ID: 0
    Started: False
    Exit Code: 0
    Accept Pause: False
    Accept Stop: False

    Unknown Service #3
    Service Name: McShield
    Display Name: McShield
    Start Mode: Manual
    Start Name: LocalSystem
    Description: McAfee On Access ...
    Service Type: Own Process
    Path: "c:\program files\common files\network associates\mcshield\mcshield.exe"
    State: Running
    Process ID: 208
    Started: True
    Exit Code: 0
    Accept Pause: False
    Accept Stop: True

    Unknown Service #4
    Service Name: SwPrv
    Display Name: MS Software Shadow Copy Provider
    Start Mode: Manual
    Start Name: LocalSystem
    Description: Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this ...
    Service Type: Own Process
    Path: c:\windows\system32\dllhost.exe /processid:{30c7c556-c8d1-46c4-b37c-6c2876e96338}
    State: Stopped
    Process ID: 0
    Started: False
    Exit Code: 1077
    Accept Pause: False
    Accept Stop: False

    Unknown Service # 5
    Service Name: ZESOFT
    Display Name: ZESOFT
    Start Mode: Auto
    Start Name: LocalSystem
    Description: ZESoft ...
    Service Type: Own Process
    Path: c:\windows\zeta.exe
    State: Stopped
    Process ID: 0
    Started: False
    Exit Code: 0
    Accept Pause: False
    Accept Stop: False

    ---> End Service Listing <---

    There are 84 Win32 services on this machine.
    5 were unrecognized.

    Script Execution Time: 2.460938 seconds.

    >From Dllcompare:
    * DLLCompare Log version(1.0.0.127)
    Files Found that Windows does not See or cannot Access
    *Not everything listed here means you are infected!
    ________________________________________________

    O^E says: "There were no files found :)"
    ________________________________________________

    1,173 items found: 1,173 files, 0 directories.
    Total of file sizes: 219,076,546 bytes 208.93 M

    Administrator Account = True
    End log


    >From HijackThis:
    Logfile of HijackThis v1.99.0
    Scan saved at 11:35:54 AM, on 12/29/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
    C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
    C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
    C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
    C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    C:\WINDOWS\System32\hphmon03.exe
    G:\Utilities\winpatrol.exe
    C:\program files\captureeze97\capeze97.exe
    C:\WINDOWS\System32\ctfmon.exe
    G:\Utilities\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\System32\HPHipm09.exe
    G:\Utilities\hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ddhpz.dll/sp.html#28129
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ddhpz.dll/sp.html#28129
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ddhpz.dll/sp.html#28129
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.jpost.com/servlet/Satellite?pagename=JPost/P/DryBones&cid=1011177744908
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://shell.windows.com/fileassoc/0409/xml/redir.asp?Ext=?ÃA????
    R3 - Default URLSearchHook is missing
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {58D0CDED-292E-A742-0F1D-80D844764A6C} - C:\WINDOWS\ntny.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\System32\hphmon03.exe
    O4 - HKLM\..\Run: [WinPatrol] G:\Utilities\winpatrol.exe
    O4 - HKCU\..\Run: [CaptureEze97] c:\program files\captureeze97\capeze97.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] G:\Utilities\Spybot - Search & Destroy\TeaTimer.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O15 - Trusted Zone: *.awmdabest.com
    O15 - Trusted Zone: *.frame.crazywinnings.com
    O15 - Trusted Zone: *.awmdabest.com (HKLM)
    O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
    O15 - Trusted IP range: 206.161.125.149
    O15 - Trusted IP range: (HKLM)
    O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} -
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe
    O19 - User stylesheet: (file missing)
    O23 - Service: AVSync Manager - Networks Associates Technologies, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
    O23 - Service: IMAPI CD-Burning COM Service - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
    O23 - Service: McShield - Unknown - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
    O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Pml Driver - HP - C:\WINDOWS\System32\HPHipm09.exe
    O23 - Service: WAN Miniport (ATW) Service - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
    O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe (file missing)

    -thanks. Doug Geiger
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited December 2004
    Go to:

    Start > Run > type "services.msc", then click OK

    Scroll down to the ZESOFT service.

    Click it to highlight it, <right-click> and select: Properties
    Select "Service Status" option to "Stop"
    Select: "Startup type" set it to "Disabled", click Apply, then OK.

    CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

    Run Hijack This!
    Click "Scan".
    Then "check" the box to the left of these item(s):

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ddhpz.dll/sp.html#28129
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\ddhpz.dll/sp.html#28129
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\ddhpz.dll/sp.html#28129
    R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank

    R3 - Default URLSearchHook is missing

    O2 - BHO: (no name) - {58D0CDED-292E-A742-0F1D-80D844764A6C} - C:\WINDOWS\ntny.dll

    O15 - Trusted Zone: *.awmdabest.com
    O15 - Trusted Zone: *.frame.crazywinnings.com
    O15 - Trusted Zone: *.awmdabest.com (HKLM)
    O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
    O15 - Trusted IP range: 206.161.125.149
    O15 - Trusted IP range: (HKLM)

    O16 - DPF: {386A771C-E96A-421F-8BA7-32F1B706892F} -

    O19 - User stylesheet: (file missing)

    O23 - Service: ZESOFT - Unknown - C:\WINDOWS\zeta.exe (file missing)

    Then click "Fix checked".

    Reboot in "safe" mode.

    Find and delete:

    c:\program files\bullseye network <--- FOLDER

    c:\windows\zeta.exe <--- file

    Some malware files may be "hidden".
    Be sure to show hidden files when looking for these file(s) and/or folder(s).

    Reboot in normal mode and "copy/paste" a new log file into this thread.

    Can you please download this file from here:

    Getservice.zip

    Extract the file to the c:\ drive. Then navigate to the c:\getservices and double-click on the getservices.bat file. A notepad will open up. Can you please attach the file to your post.
  • douggeiger
    edited December 2004
    Ok: removed the items requested. Noted that everything went away, except for 2 items-

    1) 015 - Trusted Zone: *.frame.crazywinnings.com
    2) 015 - Trusted Zone: *.frame.crazywinnings.com (HKLM)

    Repeated tries at removing these two items was not successful. I have not yet tried IE, as it seems that my PC is still not clean. Right? Also, the Zeta.exe file was not on the PC, neither was the bullseye network folder (text searches could not locate them - and I am seeing all files, including system ones).
    >So, here is the HijackThis log-

    Logfile of HijackThis v1.99.0
    Scan saved at 10:13:07 AM, on 12/30/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    C:\WINDOWS\System32\hphmon03.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
    C:\WINDOWS\System32\HPHipm09.exe
    G:\Utilities\hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.jpost.com/servlet/Satellite?pagename=JPost/P/DryBones&cid=1011177744908
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://shell.windows.com/fileassoc/0409/xml/redir.asp?Ext=?ÃA????
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\System32\hphmon03.exe
    O4 - HKLM\..\Run: [WinPatrol] G:\Utilities\winpatrol.exe
    O4 - HKCU\..\Run: [CaptureEze97] c:\program files\captureeze97\capeze97.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] G:\Utilities\Spybot - Search & Destroy\TeaTimer.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O15 - Trusted Zone: *.frame.crazywinnings.com
    O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe
    O23 - Service: AVSync Manager - Networks Associates Technologies, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
    O23 - Service: IMAPI CD-Burning COM Service - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
    O23 - Service: McShield - Unknown - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
    O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Pml Driver - HP - C:\WINDOWS\System32\HPHipm09.exe
    O23 - Service: WAN Miniport (ATW) Service - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
  • SpywareShooterSpywareShooter 127.0.0.1
    edited December 2004
    You need a special tool to get rid of those entries.

    www.mvps.org/winhelp2002/DelDomains.inf

    Download deldomains.inf. Once it is saved to your computer, right click the file and select "Install", then reboot and post a new log.
  • douggeiger
    edited December 2004
    Did as you requested. If I read my HijackThis log correctly, is my machine now clean? If so, a great big thanks, thanks, thanks!

    -Doug Geiger
    >HijackThis log:
    Logfile of HijackThis v1.99.0
    Scan saved at 10:01:52 AM, on 12/31/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    C:\WINDOWS\System32\hphmon03.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
    C:\WINDOWS\System32\HPHipm09.exe
    G:\Utilities\hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.jpost.com/servlet/Satellite?pagename=JPost/P/DryBones&cid=1011177744908
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://shell.windows.com/fileassoc/0409/xml/redir.asp?Ext=?ÃA????
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\System32\hphmon03.exe
    O4 - HKLM\..\Run: [WinPatrol] G:\Utilities\winpatrol.exe
    O4 - HKCU\..\Run: [CaptureEze97] c:\program files\captureeze97\capeze97.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] G:\Utilities\Spybot - Search & Destroy\TeaTimer.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe
    O23 - Service: AVSync Manager - Networks Associates Technologies, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
    O23 - Service: IMAPI CD-Burning COM Service - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
    O23 - Service: McShield - Unknown - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
    O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Pml Driver - HP - C:\WINDOWS\System32\HPHipm09.exe
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited December 2004
    Looks clean to me, but you really need to get service pack 1 (at least) for both XP and IE 6.

    Please go here for them.
  • douggeiger
    edited December 2004
    I thought I already had gotten SV1 for XP, but maybe I missed IE6. So will go to the MS website and download. Again, many thanks to everyone who helped out.

    Consider this Hijack stomped!

    -Doug Geiger
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited December 2004
    Looking at your log, neither of them have service packs.
  • douggeiger
    edited December 2004
    Ok, I;ve run IE->Tools->Windows Update and downloaded and installed everything it listed (30+Meg worth). Here's the newest HijackThis log. The "nwiz" listing seems to have come when I did an NVIDIA download from the Windows Update. Everything else seems the same.

    So did I get the service packs? Or is there another path I need to get them (not using Windows Update)? I've heard that Service Pack 2 should not be downloaded. True or false? thanks again for your help.
    >HijackThis log:
    Logfile of HijackThis v1.99.0
    Scan saved at 8:07:22 PM, on 12/31/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
    C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
    C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
    C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
    C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    C:\WINDOWS\System32\hphmon03.exe
    C:\program files\captureeze97\capeze97.exe
    C:\WINDOWS\System32\ctfmon.exe
    G:\Utilities\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
    G:\Utilities\WindowPatrol\WinPatrol.exe
    G:\Waybills\Waybills.exe
    C:\WINDOWS\System32\HPHipm09.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Outlook Express\msimn.exe
    G:\Utilities\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jpost.com/servlet/Satellite?pagename=JPost/P/DryBones&cid=1011177744908
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.jpost.com/servlet/Satellite?pagename=JPost/P/DryBones&cid=1011177744908
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://shell.windows.com/fileassoc/0409/xml/redir.asp?Ext=?ÃA????
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
    O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\System32\hphmon03.exe
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
    O4 - HKLM\..\Run: [WinPatrol] G:\Utilities\winpatrol.exe
    O4 - HKCU\..\Run: [CaptureEze97] c:\program files\captureeze97\capeze97.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] G:\Utilities\Spybot - Search & Destroy\TeaTimer.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1104516170332
    O17 - HKLM\System\CCS\Services\Tcpip\..\{7271AEA5-5ADD-4FE1-A8E1-993259115EB5}: NameServer = 64.58.4.2 64.58.15.2
    O23 - Service: AVSync Manager - Networks Associates Technologies, Inc. - C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
    O23 - Service: IMAPI CD-Burning COM Service - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
    O23 - Service: McShield - Unknown - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
    O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Pml Driver - HP - C:\WINDOWS\System32\HPHipm09.exe
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited December 2004
    This is how it looks when you have service packs installed;

    Logfile of HijackThis v1.99.0
    Scan saved at 4:45:27 PM, on 12/29/2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    With service pack 2 I think it's up to the user. If you go ahead with the SP2 install, your PC must be free of scumware or all sorts of problems arise.

    Did you reboot since installing the updates? I'm not sure but I think the service packs would be bigger than 30 Mb.
  • douggeiger
    edited January 2005
    Yes, the Windows Update required several reboots. So, it looks like I have not gotten the Service packs. I'll search around on MicroSofts website to see what I can find.

    On another note, after all these changes to my computer, it can no longer automatically start viewing a .pdf file from a website. I've got both Acrobat 4.0 and 6.0. I've tried having them open, then accessing a website with a .pdf, but no luck. I'm stuck. Nothing seems to be obvious in any Preferences tabs I can find. Any assistance? Might have cleaned up the machine just a bit too much <g>. thanks.

    -Doug Geiger
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2005
    Sounds like you have lost the plug-in. Have you tried reinstalling reader?
  • douggeiger
    edited January 2005
    Well, after giving up on the .pdf problem, I started the process to download service packs from Microsoft. When I started that download, I got a message saying my security settings were not sufficient to download. So, I changed the security tab under Tools->Internet Options->Internet from High to Medium. The download started ok. Just for grins, I retried the .pdf website and it also worked! So, there was some setting in Security tab that triggered the .pdf load/noload. But when I looked at all the radio buttons under the Custom Level, nothing was said specific about pdf. Oh, well. Seems to work now. Maybe if I get some time I'll investigate which radio button stopped the pdf. So now its on to the service packs. Thought you might want to know. Hope you have a great new year!

    -Doug Geiger
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited January 2005
    Thanks for the feedback. Happy new year to you too.
Sign In or Register to comment.