HijackThis
Page 1 of 2 1 2 LastLast
Results 1 to 15 of 16

Thread: HijackThis

  1. July 15th, 2004, 01:10 PM #1
    NDraper
    NDraper is offline
    Registered User
    Join Date
    Jul 2004
    Posts
    6

    HijackThis

    Hi I have the javascript problem
    This is the log from Hijackthis, please will someone advise me on what to selete.
    Thanks

    Logfile of HijackThis v1.97.7
    Scan saved at 19:02:37, on 15/07/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
    C:\PROGRA~1\Iomega\System32\AppServices.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
    C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\Pavsrv51.exe
    C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
    C:\Program Files\Iomega\AutoDisk\ADService.exe
    C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\AVENGINE.EXE
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\apvxdwin.exe
    C:\My Downloads\WinZip\WZQKPICK.EXE
    C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\WebProxy.exe
    C:\Program Files\eDonkey2000\edonkey2000.exe
    C:\Program Files\BulletProofSoft.com\SpywareRemover\Spyware.e xe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\AVLTMAIN.EXE
    C:\MYDOWN~1\WINZIP\winzip32.exe
    C:\unzipped\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\System\blank.htm
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\System\blank.htm
    R3 - Default URLSearchHook is missing
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Titanium Antivirus 2004\APVXDWIN.EXE" /s
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\My Downloads\WinZip\WZQKPICK.EXE
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: Research (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O10 - Unknown file in Winsock LSP: c:\program files\panda software\panda titanium antivirus 2004\pavlsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\panda software\panda titanium antivirus 2004\pavlsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\panda software\panda titanium antivirus 2004\pavlsp.dll
    O17 - HKLM\System\CCS\Services\Tcpip\..\{B7DAF58B-CE62-4F4C-908A-CD9E4967E6A7}: NameServer = 80.189.92.2 80.189.94.2
    Reply With Quote Reply With Quote
  2. July 15th, 2004, 02:13 PM #2
    hudsonsmith
    hudsonsmith is offline
    Registered User hudsonsmith's Avatar
    Join Date
    Feb 2003
    Location
    New York
    Posts
    2,276
    Looks pretty clean to me. The biggest threat is C:\Program Files\eDonkey2000\edonkey2000.exe (as is any peer to peer service), although I don't see it listed in the registry, only as a running service.

    I would try deleting this:
    O17 - HKLM\System\CCS\Services\Tcpip\..\{B7DAF58B-CE62-4F4C-908A-CD9E4967E6A7}: NameServer = 80.189.92.2 80.189.94.2

    and possibly these:
    O10 - Unknown file in Winsock LSP: c:\program files\panda software\panda titanium antivirus 2004\pavlsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\panda software\panda titanium antivirus 2004\pavlsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\panda software\panda titanium antivirus 2004\pavlsp.dll
    Probability factor of one to one...we have normality, I repeat we have normality. Anything you still can't cope with is therefore your own problem.
    Reply With Quote Reply With Quote
  3. July 16th, 2004, 01:05 AM #3
    tyr888
    tyr888 is offline
    Registered User tyr888's Avatar
    Join Date
    Jul 2004
    Location
    i live in a house
    Posts
    12
    first, i wanna say, i am no expert. take my advice with a grain of salt.

    i don't really know what your problem is, but i can give some advice for what i see.
    C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
    what is this?


    C:\PROGRA~1\Iomega\System32\AppServices.exe
    C:\Program Files\Iomega\AutoDisk\ADService.exe
    what is this?


    C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
    do you really need this to start?


    C:\My Downloads\WinZip\WZQKPICK.EXE
    C:\MYDOWN~1\WINZIP\winzip32.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\My Downloads\WinZip\WZQKPICK.EXE
    you don't need winzip starting with the cpu, it'll come on when you need it.


    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\System\blank.htm
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\System\blank.htm
    R3 - Default URLSearchHook is missing
    You really don't need these. the about blank page suggests a browser hacker though. google BHODemon, and use that.


    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    This is for your video card. DO _N_O_T_ DELETE THIS! you need it.
    Reply With Quote Reply With Quote
  4. July 16th, 2004, 01:34 AM #4
    GrandDad
    GrandDad is offline
    Registered User GrandDad's Avatar
    Join Date
    Apr 2001
    Location
    Ft.Leonard Wood
    Posts
    2,112
    Quote Originally Posted by tyr888
    first, i wanna say, i am no expert. take my advice with a grain of salt.

    i don't really know what your problem is, but i can give some advice for what i see.
    what is this?


    what is this?


    do you really need this to start?


    you don't need winzip starting with the cpu, it'll come on when you need it.


    You really don't need these. the about blank page suggests a browser hacker though. google BHODemon, and use that.


    This is for your video card. DO _N_O_T_ DELETE THIS! you need it.
    I would suggest you try Google ,
    you will find "CDANTSRV.EXE" is 'C-Dilla Ltd / Macrovision'
    "\Ulead Systems\DVD\ULCDRSvr.exe" is probably related to above

    you find "Iomega" is his Zip drive

    "R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\System\blank.htm
    R3 - Default URLSearchHook is missing"
    that only suggest it hasn't been set or deleted

    Do a little research please before suggesting to people to delete or turn-off things without knowing what they are , Ok .
    Last edited by GrandDad; July 16th, 2004 at 01:43 AM.
    Reply With Quote Reply With Quote
  5. July 16th, 2004, 03:57 AM #5
    NooNoo
    NooNoo is offline
    Driver Terrier NooNoo's Avatar
    Join Date
    Dec 2000
    Location
    UK
    Posts
    31,824
    Good advice Grandad

    Ndraper, you have wintools

    C:\WINDOWS\system32\winlogon.exe

    you need to get rid of it and edonkey!

    the last link in the first post here has a link to removing wintools.

    You should read the rest of the post so that you know how to deal with future spyware.
    Reply With Quote Reply With Quote
  6. July 16th, 2004, 06:13 AM #6
    hudsonsmith
    hudsonsmith is offline
    Registered User hudsonsmith's Avatar
    Join Date
    Feb 2003
    Location
    New York
    Posts
    2,276
    You sure about the wintools Noo? C:\WINDOWS\system32\winlogon.exe is a valid windows system file. I thought it was bad only when not in the system32 directory.

    http://www.answersthatwork.com/Taskl...tasklist_w.htm
    Reply With Quote Reply With Quote
  7. July 16th, 2004, 06:24 AM #7
    NooNoo
    NooNoo is offline
    Driver Terrier NooNoo's Avatar
    Join Date
    Dec 2000
    Location
    UK
    Posts
    31,824
    http://www.liutilities.com/products/...rary/winlogin/

    hmmm where is my coffee?
    Reply With Quote Reply With Quote
  8. July 16th, 2004, 02:00 PM #8
    ANumber1
    ANumber1 is offline
    Registered User ANumber1's Avatar
    Join Date
    Feb 2003
    Posts
    8
    The bad one is winlogin.exe
    Reply With Quote Reply With Quote
  9. July 16th, 2004, 07:57 PM #9
    Cry
    Cry is offline
    Registered User
    Join Date
    Jul 2004
    Posts
    11
    Well first off GET A BETTER AV god... get Kaspersky its the bests HANDS DOWN. i use kav to test hexing Servers. and Tds-3 is very good for scaning. use google to get them trial
    Reply With Quote Reply With Quote
  10. July 17th, 2004, 02:31 PM #10
    tyr888
    tyr888 is offline
    Registered User tyr888's Avatar
    Join Date
    Jul 2004
    Location
    i live in a house
    Posts
    12
    Quote Originally Posted by GrandDad
    I would suggest you try Google ,
    you will find "CDANTSRV.EXE" is 'C-Dilla Ltd / Macrovision'
    "\Ulead Systems\DVD\ULCDRSvr.exe" is probably related to above

    you find "Iomega" is his Zip drive

    Do a little research please before suggesting to people to delete or turn-off things without knowing what they are , Ok .
    (i erased the middle part, with the start pages)

    i never told him to delete those, i said i didn't know what it was,
    and said it so that he would look into it, in the event that he didn't
    know what it was either.

    i'm not mad though, like many people who get oversensitive about
    being rebuked, but yea, i could have checked further into
    that myself. that is why at the top, i posted that i am not an
    expert.

    also, my zip drive doesn't show up on my hijack log, and it works fine,
    that's why i ask if he needs them there.
    That which is is that which was, that which will be again.
    And this, i see, will once more be, not that i give a damn.
    Reply With Quote Reply With Quote
  11. July 17th, 2004, 03:01 PM #11
    GrandDad
    GrandDad is offline
    Registered User GrandDad's Avatar
    Join Date
    Apr 2001
    Location
    Ft.Leonard Wood
    Posts
    2,112
    Quote Originally Posted by tyr888
    (i erased the middle part, with the start pages)

    i never told him to delete those, i said i didn't know what it was,
    and said it so that he would look into it, in the event that he didn't
    know what it was either.

    i'm not mad though, like many people who get oversensitive about
    being rebuked, but yea, i could have checked further into
    that myself. that is why at the top, i posted that i am not an
    expert.

    also, my zip drive doesn't show up on my hijack log, and it works fine,
    that's why i ask if he needs them there.
    I understand that .

    The whole thing is to be careful of what and how you may say or tell somebody to do , many that come here may be a first time PC buyer or user and have no idea of what or how to do something .

    I'm no expert either and I and others have been asked to be more careful .
    so your not the first or will be the last one .

    Your more than welcome to help around here if you wish to .

    Like they say The more the merry .
    Reply With Quote Reply With Quote
  12. July 18th, 2004, 02:48 PM #12
    NDraper
    NDraper is offline
    Registered User
    Join Date
    Jul 2004
    Posts
    6
    I have removed the panda titanium antivirus software, but still am not sure what to delete as I had mixed messages.
    Here is the most recent log.
    Thanks

    Logfile of HijackThis v1.97.7
    Scan saved at 20:47:06, on 18/07/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\SYSTEM32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
    C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
    C:\PROGRA~1\Iomega\System32\AppServices.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
    C:\Program Files\Iomega\AutoDisk\ADService.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
    C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    C:\My Downloads\WinZip\WZQKPICK.EXE
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
    C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
    C:\Downloads\Apps\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\System\blank.htm
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\System\blank.htm
    R3 - Default URLSearchHook is missing
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\My Downloads\WinZip\WZQKPICK.EXE
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O9 - Extra button: Research (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeup...ntent/opuc.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{B7DAF58B-CE62-4F4C-908A-CD9E4967E6A7}: NameServer = 80.189.92.2 80.189.94.2
    Reply With Quote Reply With Quote
  13. July 18th, 2004, 04:47 PM #13
    NooNoo
    NooNoo is offline
    Driver Terrier NooNoo's Avatar
    Join Date
    Dec 2000
    Location
    UK
    Posts
    31,824
    O17 - HKLM\System\CCS\Services\Tcpip\..\{B7DAF58B-CE62-4F4C-908A-CD9E4967E6A7}: NameServer = 80.189.92.2 80.189.94.2

    Is the only one I would get rid of....everything else looks fine.
    Reply With Quote Reply With Quote
  14. July 19th, 2004, 12:31 AM #14
    tyr888
    tyr888 is offline
    Registered User tyr888's Avatar
    Join Date
    Jul 2004
    Location
    i live in a house
    Posts
    12
    O17 - HKLM\System\CCS\Services\Tcpip\..\{B7DAF58B-CE62-4F4C-908A-CD9E4967E6A7}: NameServer = 80.189.92.2 80.189.94.2
    on an ip lookup, 80.189.92.2 and 80.189.94.2 appears to come from
    http://brightview.com/home/index.html . Ndraper, do you know who they are? are they your email company or something?
    Reply With Quote Reply With Quote
  15. July 19th, 2004, 11:32 AM #15
    NDraper
    NDraper is offline
    Registered User
    Join Date
    Jul 2004
    Posts
    6
    Yes they are my ISP.
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Similar Threads

  1. Input Issues on Dell Inspiron 8200
    By PacoL250 in forum Laptops/PDAs/Smartphones
    Replies: 19
    Last Post: November 18th, 2004, 03:19 PM
  2. HijackThis log..What do i get rid of?
    By houllier* in forum Windows XP
    Replies: 7
    Last Post: July 18th, 2004, 04:44 PM
  3. Can't get rid of res://ivfsh.dll/index.html#96676??
    By giant96 in forum Spyware & Antivirus - Security
    Replies: 8
    Last Post: June 25th, 2004, 02:06 PM
  4. All-find.net porn pop-up HijackThis log
    By Rev Fred in forum Spyware & Antivirus - Security
    Replies: 7
    Last Post: June 10th, 2004, 10:50 AM
  5. Still having problems with spyware, need help
    By awgreig in forum Spyware & Antivirus - Security
    Replies: 4
    Last Post: May 1st, 2004, 05:51 AM

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules