HJT log Review Please - jayta

Comments

• shwaip bluffin' with my muffin Icrontian

  June 2004 edited June 2004

  It's looking pretty good. Boot into safe mode and remove the following:
  
  O2 - BHO: (no name) - {63CF97E8-4133-438a-A831-CC9C6D47D673} - (no file)
  O2 - BHO: (no name) - {7371F073-AC0F-4b80-BB2F-96A488CEFB32} - (no file)
  
  resource hogs
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeNetworking\P2P Networking.exe /AUTOSTART
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  
  malware
  O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P
  
  These are downloaded program files. If you do not recognize the site, remove them
  O16 - DPF: {02CA9974-B6AC-497E-A371-73580432B0F6} (Eyeball Video Message Control) - http://ezcheating.com/ChatSource/hVideoContol.cab
  O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
  O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.jwcinc.net/Cache/Include/XUpload.ocx
  O16 - DPF: {FF452CFC-7056-4A5D-A327-1DFEC8EDC82A} (Upload Class) - http://www.neptune.com/features/upload/ms40upld.ocx

  0
• jayta

  June 2004 edited June 2004

  Thanks so much for helping me out here. Here is my modified logfile. If you could possibly check it out....
  
  Also wondering if someone could help me out with this problem I've been having when starting up. I login to my acct and my C: Windows browser always keeps opening by itself. I never set it to do so. How can I make it stop?
  
  And also wondering if I've been deleting my files correctly. I have gone into safemode and then gone into HJT to delete those files you said weren't good for my computer. If not, please let me know of a better way?
  
  Anways here is my logfile
  
  Logfile of HijackThis v1.97.7
  Scan saved at 1:48:25 AM, on 21/06/2004
  Platform: Windows XP SP1 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\SOUNDMAN.EXE
  C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
  C:\WINDOWS\SYSTEM32\USRmlnkA.exe
  C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\Program Files\Norton AntiVirus\navapsvc.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\BTV\btv.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\WINDOWS\SYSTEM32\USRshutA.exe
  C:\WINDOWS\SYSTEM32\USRmlnkA.exe
  C:\Program Files\Norton AntiVirus\SAVScan.exe
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\WinZip\WZQKPICK.EXE
  C:\WINDOWS\System32\wuauclt.exe
  C:\Program Files\Internet Explorer\IEXPLORE.EXE
  C:\Program Files\Hijack This\HijackThis.exe
  
  O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
  O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
  O4 - HKLM\..\Run: [USRpdA] C:\WINDOWS\SYSTEM32\USRmlnkA.exe RunServices \Device\3cpipe-USRpdA
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [Jreg] "C:\Program Files\Common Files\Java\Jreg2b.exe"
  O4 - HKLM\..\Run: [BTV] C:\Program Files\BTV\btv.exe
  O4 - HKLM\..\Run: [Breg] "C:\Program Files\Common Files\Java\breg.exe"
  O4 - HKCU\..\Run: [Morpheus] "C:\Program Files\StreamCast\Morpheus\Morpheus.exe" -min
  O4 - HKCU\..\Run: [schedsvc] C:\WINDOWS\System32\schedsvc.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [MessengerPlus3] "\" /WinStart
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
  O9 - Extra button: Messenger (HKLM)
  O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
  O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
  O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
  O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/208ebb4b4097bd744603/netzip/RdxIE601.cab
  O16 - DPF: {5E943D9C-F8DC-4258-8E3F-A61BB3405A33} - http://www.imagestation.com/common/classes/batchdwnl.cab?version=4,3,2,20802
  O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
  O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.jwcinc.net/Cache/Include/XUpload.ocx
  O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
  O16 - DPF: {FF452CFC-7056-4A5D-A327-1DFEC8EDC82A} (Upload Class) - http://www.neptune.com/features/upload/ms40upld.ocx

  0