Options

Re Please help with Hijackthis log???

Please help with the following HijackThis Log.
Which items need to be deleted.
I have tried following the directions in the "sticky" but the mentioned items do not exist in my log.
Thankyou
Gordon

Logfile of HijackThis v1.99.1
Scan saved at 1:51:16 PM, on 6/7/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\DELLMMKB.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Ad-Protect\ad-protect.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Ad-Protect\ad-protect.exe
C:\Program Files\Netropa\OSD.exe
C:\Documents and Settings\larryl\Local Settings\Temp\Temporary Directory 3 for hijackthis_199.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microso
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=http://127.0.0.1:8080
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CIEExtension Object - {B51DC573-E998-4834-9B45-BAB7C2AE0A75} - C:\Program Files\Ad-Protect\ADPIEmonitor.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Ad-Protect Toolbar - {EA038DDD-0FE0-41f5-BA60-FC3660529E71} - C:\Program Files\Ad-Protect\ToolBand.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [Ad-Protect] C:\Program Files\Ad-Protect\ad-protect.exe /s
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Internet Connection Wizard] stisvsq.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Microsoft AntiSpyware helper - {04973AD6-4609-473D-ACCF-53CA2FEFFF08} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {04973AD6-4609-473D-ACCF-53CA2FEFFF08} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {1795DFFA-BF8B-4EB3-85F0-9EF0B64D1FA5} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {1795DFFA-BF8B-4EB3-85F0-9EF0B64D1FA5} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {1C5A2855-5632-4540-ADAE-F48239DC8680} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {1C5A2855-5632-4540-ADAE-F48239DC8680} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {21E60003-27FE-4F0A-BBDE-A5782FA39D74} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {21E60003-27FE-4F0A-BBDE-A5782FA39D74} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {234EDCD0-B50E-4548-B70B-0D31426CD000} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {234EDCD0-B50E-4548-B70B-0D31426CD000} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {33D160FB-E56F-4928-B236-B763E027C1C0} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {33D160FB-E56F-4928-B236-B763E027C1C0} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {54693878-A7B1-4A6B-84A4-A3CC6123942E} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {54693878-A7B1-4A6B-84A4-A3CC6123942E} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {57B42076-1DEA-45DE-9884-5DEC2289CFF7} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {57B42076-1DEA-45DE-9884-5DEC2289CFF7} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {6A99034C-80F6-4491-8CF6-355CF10928E0} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {6A99034C-80F6-4491-8CF6-355CF10928E0} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {7512E8FF-3865-46E9-849C-0A23416220E4} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {7512E8FF-3865-46E9-849C-0A23416220E4} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {78B0D74F-91AA-44D4-96B7-B2E8650443D3} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {78B0D74F-91AA-44D4-96B7-B2E8650443D3} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {7C2C9075-A41D-4792-AAB1-9C4258A2389B} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {7C2C9075-A41D-4792-AAB1-9C4258A2389B} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {A0754E4C-35E9-45E0-BA54-C45D992029BC} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {A0754E4C-35E9-45E0-BA54-C45D992029BC} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {AAB2A6DA-B94E-4E10-B1D3-B55E74BA8BA6} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {AAB2A6DA-B94E-4E10-B1D3-B55E74BA8BA6} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {C3ECBA3B-14A6-45A1-BBC9-ADD3EDC3A8C2} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {C3ECBA3B-14A6-45A1-BBC9-ADD3EDC3A8C2} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {CFDF4B51-0991-4345-A50E-4E1A49D3D6DE} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {CFDF4B51-0991-4345-A50E-4E1A49D3D6DE} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {F6B0325F-55A9-46D8-BA99-E9AE81199D7F} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {F6B0325F-55A9-46D8-BA99-E9AE81199D7F} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {FA8FA24E-4516-40E2-B15C-89ADA13D8755} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {FA8FA24E-4516-40E2-B15C-89ADA13D8755} - (no file) (HKCU)
O9 - Extra button: Microsoft AntiSpyware helper - {FD42B6D6-3D8C-4C47-9D20-0DB5CC99D769} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {FD42B6D6-3D8C-4C47-9D20-0DB5CC99D769} - (no file) (HKCU)
O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://192.168.0.18/tsweb/msrdp.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Kwikkerbhq.com
O17 - HKLM\Software\..\Telephony: DomainName = Kwikkerbhq.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Kwikkerbhq.com
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: AVKernel - WinSoftware, Ltd. - C:\Program Files\WinAntiVirus 2005 Pro\AVKernel.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Comments

  • SpywareShooterSpywareShooter 127.0.0.1
    edited June 2005
    O9 - Extra button: Microsoft AntiSpyware helper - {04973AD6-4609-473D-ACCF-53CA2FEFFF08} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {04973AD6-4609-473D-ACCF-53CA2FEFFF08} - (no file) (HKCU)
    O9 - Extra button: Microsoft AntiSpyware helper - {1795DFFA-BF8B-4EB3-85F0-9EF0B64D1FA5} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {1795DFFA-BF8B-4EB3-85F0-9EF0B64D1FA5} - (no file) (HKCU)
    O9 - Extra button: Microsoft AntiSpyware helper - {1C5A2855-5632-4540-ADAE-F48239DC8680} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {1C5A2855-5632-4540-ADAE-F48239DC8680} - (no file) (HKCU)
    O9 - Extra button: Microsoft AntiSpyware helper - {21E60003-27FE-4F0A-BBDE-A5782FA39D74} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {21E60003-27FE-4F0A-BBDE-A5782FA39D74} - (no file) (HKCU)
    O9 - Extra button: Microsoft AntiSpyware helper - {234EDCD0-B50E-4548-B70B-0D31426CD000} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {234EDCD0-B50E-4548-B70B-0D31426CD000} - (no file) (HKCU)
    O9 - Extra button: Microsoft AntiSpyware helper - {33D160FB-E56F-4928-B236-B763E027C1C0} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {33D160FB-E56F-4928-B236-B763E027C1C0} - (no file) (HKCU)
    O9 - Extra button: Microsoft AntiSpyware helper - {54693878-A7B1-4A6B-84A4-A3CC6123942E} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {54693878-A7B1-4A6B-84A4-A3CC6123942E} - (no file) (HKCU)
    O9 - Extra button: Microsoft AntiSpyware helper - {57B42076-1DEA-45DE-9884-5DEC2289CFF7} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {57B42076-1DEA-45DE-9884-5DEC2289CFF7} - (no file) (HKCU)
    O9 - Extra button: Microsoft AntiSpyware helper - {6A99034C-80F6-4491-8CF6-355CF10928E0} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {6A99034C-80F6-4491-8CF6-355CF10928E0} - (no file) (HKCU)
    O9 - Extra button: Microsoft AntiSpyware helper - {7512E8FF-3865-46E9-849C-0A23416220E4} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {7512E8FF-3865-46E9-849C-0A23416220E4} - (no file) (HKCU)
    O9 - Extra button: Microsoft AntiSpyware helper - {78B0D74F-91AA-44D4-96B7-B2E8650443D3} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {78B0D74F-91AA-44D4-96B7-B2E8650443D3} - (no file) (HKCU)
    O9 - Extra button: Microsoft AntiSpyware helper - {7C2C9075-A41D-4792-AAB1-9C4258A2389B} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {7C2C9075-A41D-4792-AAB1-9C4258A2389B} - (no file) (HKCU)
    O9 - Extra button: Microsoft AntiSpyware helper - {A0754E4C-35E9-45E0-BA54-C45D992029BC} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {A0754E4C-35E9-45E0-BA54-C45D992029BC} - (no file) (HKCU)
    O9 - Extra button: Microsoft AntiSpyware helper - {AAB2A6DA-B94E-4E10-B1D3-B55E74BA8BA6} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {AAB2A6DA-B94E-4E10-B1D3-B55E74BA8BA6} - (no file) (HKCU)
    O9 - Extra button: Microsoft AntiSpyware helper - {C3ECBA3B-14A6-45A1-BBC9-ADD3EDC3A8C2} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {C3ECBA3B-14A6-45A1-BBC9-ADD3EDC3A8C2} - (no file) (HKCU)
    O9 - Extra button: Microsoft AntiSpyware helper - {CFDF4B51-0991-4345-A50E-4E1A49D3D6DE} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {CFDF4B51-0991-4345-A50E-4E1A49D3D6DE} - (no file) (HKCU)
    O9 - Extra button: Microsoft AntiSpyware helper - {F6B0325F-55A9-46D8-BA99-E9AE81199D7F} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {F6B0325F-55A9-46D8-BA99-E9AE81199D7F} - (no file) (HKCU)
    O9 - Extra button: Microsoft AntiSpyware helper - {FA8FA24E-4516-40E2-B15C-89ADA13D8755} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {FA8FA24E-4516-40E2-B15C-89ADA13D8755} - (no file) (HKCU)
    O9 - Extra button: Microsoft AntiSpyware helper - {FD42B6D6-3D8C-4C47-9D20-0DB5CC99D769} - (no file) (HKCU)
    O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {FD42B6D6-3D8C-4C47-9D20-0DB5CC99D769} - (no file) (HKCU)

    Fix those entries then reboot and post a new log.
  • edited June 2005
    I can no longer get the machine to boot after following the above instructions.
    I get to a blue screen with a Panda in the bottom right hand corner.
    At this point Ctrl,Alt,Del doesn't work either,.
    I logged on in safe mode and ran Hijckthis. Log file below.

    Logfile of HijackThis v1.99.1
    Scan saved at 4:46:18 PM, on 6/7/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Documents and Settings\administrator.KWIKKERBHQ\Local Settings\Temp\Temporary Directory 2 for hijackthis_199.zip\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: CIEExtension Object - {B51DC573-E998-4834-9B45-BAB7C2AE0A75} - C:\Program Files\Ad-Protect\ADPIEmonitor.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Ad-Protect Toolbar - {EA038DDD-0FE0-41f5-BA60-FC3660529E71} - C:\Program Files\Ad-Protect\ToolBand.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
    O4 - HKLM\..\Run: [Ad-Protect] C:\Program Files\Ad-Protect\ad-protect.exe /s
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
    O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
    O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
    O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
    O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
    O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
    O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://192.168.0.18/tsweb/msrdp.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Kwikkerbhq.com
    O17 - HKLM\Software\..\Telephony: DomainName = Kwikkerbhq.com
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Kwikkerbhq.com
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
    O23 - Service: AVKernel - WinSoftware, Ltd. - C:\Program Files\WinAntiVirus 2005 Pro\AVKernel.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
    O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
    O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
    O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
    O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
  • SpywareShooterSpywareShooter 127.0.0.1
    edited June 2005
    This is just an idea... where you say you see the panda maybe its related to the antivirus?

    O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\APVXDWIN.EXE" /s
    O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
    O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
    O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
    O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
    O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe

    Fix those entries then reboot and post a new log.
  • edited June 2005
    New log file after changes below.
    Thankyou once again.
    kwikkerb

    Logfile of HijackThis v1.99.1
    Scan saved at 6:46:52 PM, on 6/7/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\Explorer.EXE
    C:\Documents and Settings\larryl\Local Settings\Temp\Temporary Directory 5 for hijackthis_199.zip\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microso
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=http://127.0.0.1:8080
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: CIEExtension Object - {B51DC573-E998-4834-9B45-BAB7C2AE0A75} - C:\Program Files\Ad-Protect\ADPIEmonitor.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Ad-Protect Toolbar - {EA038DDD-0FE0-41f5-BA60-FC3660529E71} - C:\Program Files\Ad-Protect\ToolBand.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
    O4 - HKLM\..\Run: [Ad-Protect] C:\Program Files\Ad-Protect\ad-protect.exe /s
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Internet Connection Wizard] stisvsq.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
    O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
    O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
    O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
    O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
    O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
    O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://192.168.0.18/tsweb/msrdp.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Kwikkerbhq.com
    O17 - HKLM\Software\..\Telephony: DomainName = Kwikkerbhq.com
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Kwikkerbhq.com
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
    O23 - Service: AVKernel - WinSoftware, Ltd. - C:\Program Files\WinAntiVirus 2005 Pro\AVKernel.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
    O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
    O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
    O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
    O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
  • SpywareShooterSpywareShooter 127.0.0.1
    edited June 2005
    O4 - HKCU\..\Run: [Internet Connection Wizard] stisvsq.exe

    Fix those entries then find and delete this file:
    stisvsq.exe

    Then reboot and post a new log in normal mode if possible.
  • edited June 2005
    Done Logfile below.
    Logged on in normal mode this time

    Logfile of HijackThis v1.99.1
    Scan saved at 7:01:35 PM, on 6/7/2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
    C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\WebProxy.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\hkcmd.exe
    C:\WINDOWS\DELLMMKB.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\Program Files\Ad-Protect\ad-protect.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\Ad-Protect\ad-protect.exe
    C:\Program Files\Netropa\OSD.exe
    C:\Documents and Settings\administrator.KWIKKERBHQ\Local Settings\Temp\Temporary Directory 3 for hijackthis_199.zip\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: CIEExtension Object - {B51DC573-E998-4834-9B45-BAB7C2AE0A75} - C:\Program Files\Ad-Protect\ADPIEmonitor.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Ad-Protect Toolbar - {EA038DDD-0FE0-41f5-BA60-FC3660529E71} - C:\Program Files\Ad-Protect\ToolBand.dll
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [DellTouch] C:\WINDOWS\DELLMMKB.EXE
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
    O4 - HKLM\..\Run: [Ad-Protect] C:\Program Files\Ad-Protect\ad-protect.exe /s
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
    O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
    O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
    O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
    O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
    O10 - Unknown file in Winsock LSP: c:\program files\winantivirus 2005 pro\mailscan.dll
    O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://192.168.0.18/tsweb/msrdp.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Kwikkerbhq.com
    O17 - HKLM\Software\..\Telephony: DomainName = Kwikkerbhq.com
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Kwikkerbhq.com
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
    O23 - Service: AVKernel - WinSoftware, Ltd. - C:\Program Files\WinAntiVirus 2005 Pro\AVKernel.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Firewall\PavFires.exe
    O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavFnSvr.exe
    O23 - Service: Panda Pavkre (Pavkre) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\Pavkre.exe
    O23 - Service: Panda PavProt (PavProt) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PavProt.exe
    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\pavsrv51.exe
    O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\prevsrv.exe
    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - C:\Program Files\Panda Software\Panda Titanium Antivirus 2005\PsImSvc.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
Sign In or Register to comment.