Forum Home
Press F1
Thread ID: 96907	2009-01-28 10:53:00	Hijackthis Log	ZapperBoy10647 (11988)	Press F1

Post ID	Timestamp	Content	User
742776	2009-01-28 10:53:00	Logfile of Trend Micro HijackThis v2 . 0 . 2 Scan saved at 11:51:22 p . m . , on 28/01/2009 Platform: Windows XP SP3 (WinNT 5 . 01 . 2600) MSIE: Internet Explorer v7 . 00 (7 . 00 . 6000 . 16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss . exe C:\WINDOWS\system32\winlogon . exe C:\WINDOWS\system32\services . exe C:\WINDOWS\system32\lsass . exe C:\WINDOWS\system32\svchost . exe C:\WINDOWS\System32\svchost . exe C:\WINDOWS\system32\svchost . exe C:\WINDOWS\system32\spoolsv . exe C:\PROGRA~1\AVG\AVG8\avgwdsvc . exe C:\PROGRA~1\AVG\AVG8\avgfws8 . exe C:\Program Files\Hotspot Shield\bin\openvpnas . exe C:\Program Files\Java\jre6\bin\jqs . exe C:\Program Files\Common Files\LightScribe\LSSrvc . exe C:\PROGRA~1\AVG\AVG8\avgam . exe C:\PROGRA~1\AVG\AVG8\avgrsx . exe C:\WINDOWS\system32\nvsvc32 . exe C:\Program Files\Sandboxie\SbieSvc . exe C:\WINDOWS\system32\svchost . exe C:\PROGRA~1\AVG\AVG8\avgemc . exe C:\Program Files\AVG\AVG8\avgcsrvx . exe C:\WINDOWS\System32\svchost . exe C:\WINDOWS\Explorer . EXE C:\WINDOWS\RTHDCPL . EXE C:\WINDOWS\system32\RUNDLL32 . EXE C:\PROGRA~1\AVG\AVG8\avgtray . exe C:\Program Files\Java\jre6\bin\jusched . exe C:\Program Files\Spybot - Search & Destroy\TeaTimer . exe C:\Program Files\DAEMON Tools Lite\daemon . exe C:\PROGRA~1\AVG\AVG8\avgnsx . exe C:\Documents and Settings\Joseph\My Documents\Typpo\DCT 3 . 1 . 9 . exe C:\WINDOWS\system32\ctfmon . exe C:\Program Files\Windows Live\Messenger\msnmsgr . exe C:\Program Files\Windows Live\Contacts\wlcomm . exe C:\Program Files\Mozilla Firefox\firefox . exe C:\Program Files\ESET\ESET Smart Security\ekrn . exe C:\Program Files\ESET\ESET Smart Security\egui . exe C:\Monzilla Downloads\HiJackThis . exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://xtra . co . nz R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = . microsoft . com/fwlink/?LinkId=69157" target="_blank">go . microsoft . com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = . microsoft . com/fwlink/?LinkId=54896" target="_blank">go . microsoft . com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = . microsoft . com/fwlink/?LinkId=54896" target="_blank">go . microsoft . com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = . microsoft . com/fwlink/?LinkId=69157" target="_blank">go . microsoft . com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7 . 0\ActiveX\AcroIEHelper . dll O2 - BHO: WormRadar . com IESiteBlocker . NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie . dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper . dll O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv . dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin . dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1 . DLL O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv . dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin . dll O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\hssie\HssIE . dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1 . DLL O4 - HKLM\ . . \Run: [NvCplDaemon] RUNDLL32 . EXE C:\WINDOWS\system32\NvCpl . dll,NvStartup O4 - HKLM\ . . \Run: [nwiz] nwiz . exe /install O4 - HKLM\ . . \Run: [RTHDCPL] RTHDCPL . EXE O4 - HKLM\ . . \Run: [NvMediaCenter] RUNDLL32 . EXE C:\WINDOWS\system32\NvMcTray . dll,NvTaskbarInit O4 - HKLM\ . . \Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray . exe O4 - HKLM\ . . \Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck . exe O4 - HKLM\ . . \Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched . exe" O4 - HKLM\ . . \Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui . exe" /hide /waitservice O4 - HKCU\ . . \Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer . exe O4 - HKCU\ . . \Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon . exe" -autorun O4 - Global Startup: Adobe Reader Speed Launch . lnk . disabled O4 - Global Startup: Sonic CinePlayer Quick Launch . lnk . disabled O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL . EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR . DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper . dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper . dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag . exe O9 - Extra 'Tools' menuitem: @xpsp3res . dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag . exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs . exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs . exe O9 - Extra button: UltimateBet - {3EB3B7E8-1466-405A-B5BC-44513AF85E34} - C:\Documents and Settings\All Users\Start Menu\Programs\UltimateBet\UltimateBet . lnk (HKCU) O9 - Extra 'Tools' menuitem: UltimateBet - {3EB3B7E8-1466-405A-B5BC-44513AF85E34} - C:\Documents and Settings\All Users\Start Menu\Programs\UltimateBet\UltimateBet . lnk (HKCU) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - . macromedia . com/get/shockwave/cabs/flash/swflash . cab" target="_blank">fpdownload2 . macromedia . com O17 - HKLM\System\CCS\Services\Tcpip\ . . \{436F0165-5E1E-4C03-921F-14973E1D12E1}: NameServer = 10 . 11 . 176 . 1 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp . dll O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx . dll O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s . r . o . - C:\PROGRA~1\AVG\AVG8\avgemc . exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s . r . o . - C:\PROGRA~1\AVG\AVG8\avgwdsvc . exe O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s . r . o . - C:\PROGRA~1\AVG\AVG8\avgfws8 . exe O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv . exe O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn . exe O23 - Service: FLEXnet Licensing Service - Acresso Software Inc . - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService . exe O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas . exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc . - C:\Program Files\Java\jre6\bin\jqs . exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc . exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService . exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32 . exe O23 - Service: Sandboxie Service (SbieSvc) - tzuk - C:\Program Files\Sandboxie\SbieSvc . exe -- End of file - 7823 bytes Decided after my last post to post a log and ask you guys to check it out .	ZapperBoy10647 (11988)
742777	2009-01-28 19:38:00	No obvious nasties, you can dump O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) But either dump AVG and pay for Nod32, or remove Nod32 and use the free AVG, they will conflict ---- and dont go using keygens - lots of those have nasties embedded . Its amazing how many PC's Techs like myself clean out infections and keygens are detected by Nod32 as bugs .	wainuitech (129)
742778	2009-01-29 03:17:00	Thanks. had to dump nod32. it was blocking everything; and didnt even ask when to block unlike avg. bit of a bummer but o well.	ZapperBoy10647 (11988)
1