| Forum Home | ||||
| Press F1 | ||||
| Thread ID: 68244 | 2006-04-22 07:32:00 | Possible spyware??? | The_End_Of_Reality (334) | Press F1 |
| Post ID | Timestamp | Content | User | ||
| 448447 | 2006-04-22 07:32:00 | Hey Guys. I am on a friends PC and I am sure there is a large amount of crap on this (spyware and what not) :nerd: Anyway here is the HJT log Logfile of HijackThis v1.99.1 Scan saved at 6:26:21 p.m., on 22/04/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\RunDll32.exe C:\WINDOWS\htpatch.exe C:\WINDOWS\System32\sistray.EXE C:\WINDOWS\System32\khooker.exe C:\WINDOWS\system32\CTHELPER.EXE C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe C:\Program Files\ISTsvc\istsvc.exe C:\WINDOWS\dcubaif.exe C:\Program Files\SurfAccuracy\SAcc.exe C:\Program Files\Internet Optimizer\optimize.exe C:\WINDOWS\logon.exe C:\Program Files\Jefeb\Vbfrg.exe C:\Program Files\Block Checker\block-checker.exe C:\WINDOWS\system32\P2P Networking\P2P Networking.exe C:\Program Files\Kazaa\kazaa.exe C:\Program Files\Altnet\Points Manager\Points Manager.exe C:\PROGRA~1\MyWay\bar\3.bin\mwsoemon.exe C:\Program Files\TBONBin\tbon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Internet Optimizer\actalert.exe C:\PROGRA~1\Altnet\DOWNLO~1\asm.exe C:\Program Files\Outlook Express\msimn.exe C:\PROGRA~1\Altnet\DOWNLO~1\adm4005.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\drwtsn32.exe C:\DOCUME~1\PHILTO~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe C:\WINDOWS\system32\drwtsn32.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.nz/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com/ R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) R3 - URLSearchHook: (no name) - _{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file) R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWay\SearchAt\3.bin\MWSSRCAS.DLL R3 - URLSearchHook: (no name) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file) O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWay\SearchAt\3.bin\MWSSRCAS.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWay\bar\3.bin\MWSBAR.DLL O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll O2 - BHO: InstaFinderK - {4E7BD74F-2B8D-469E-90F0-F66AB581A933} - C:\PROGRA~1\INSTAF~1\INSTAF~1.DLL O2 - BHO: RXResultTracker Class - {59879FA4-4790-461c-A1CC-4EC4DE4CA483} - C:\Program Files\RXToolBar\sfcont.dll (file missing) O2 - BHO: BHObj Class - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\wsem303.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: System Process - {C2EEB4FA-B6D6-41b9-9CFA-ABA87F862BCB} - C:\WINDOWS\system32\navshext1.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\MOUSEW~1\SYSTEM\EM_EXEC.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\System32\sistray.EXE O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MyWay\bar\3.bin\mwsoemon.exe O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe O4 - HKLM\..\Run: [gGfZdea] C:\WINDOWS\dcubaif.exe O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe" O4 - HKLM\..\Run: [WinLogon] C:\WINDOWS\logon.exe O4 - HKLM\..\Run: [Xujsm] C:\Program Files\Jefeb\Vbfrg.exe O4 - HKLM\..\Run: [Á³# *L"h'þ9Óœð3rÅWC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\dcubaif.exe O4 - HKLM\..\Run: [BlockChecker] C:\Program Files\Block Checker\block-checker.exe O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\system32\P2P Networking\P2P Networking.exe /AUTOSTART O4 - HKLM\..\Run: [KAZAA] C:\Program Files\Kazaa\kazaa.exe /SYSTRAY O4 - HKLM\..\Run: [SemanticInsight] C:\Program Files\RXToolBar\Semantic Insight\SemanticInsight.exe O4 - HKLM\..\Run: [AltnetPointsManager] C:\Program Files\Altnet\Points Manager\Points Manager.exe -s O4 - HKLM\..\RunOnce: [DeleteYourSiteBar] rundll32.exe advpack.dll,DelNodeRunDLL32 "C:\Program Files\YourSiteBar\ysb.dll" O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe" O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MyWay\bar\3.bin\mwsoemon.exe O4 - HKCU\..\Run: [Error Safe] "C:\Program Files\Error Safe Free\ers.exe" /scan O4 - HKCU\..\Run: [tbon] C:\Program Files\TBONBin\tbon.exe /r O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWay\bar\3.bin\MWSOEMON.EXE O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWay\bar\3.bin\MWSOEMON.EXE O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Search - bar.mywebsearch.com O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://global.acer.com/ O16 - DPF: {00000000-0000-0000-0000-000020040000} - 207.234.185.217 O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - ak.imgfarm.com O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) - O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - www.ysbweb.com O16 - DPF: {8FCDF9D9-A28B-480F-8C3D-581F119A8AB8} (MediaGatewayX) - static.zangocash.com O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - messenger.msn.com O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - locator1.cdn.imagesrvr.com O17 - HKLM\System\CCS\Services\Tcpip\..\{C4D13E34-00E5-47BA-820A-4F659D2A97D1}: NameServer = 203.96.152.4 203.96.152.12 O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - C:\Program Files\RXToolBar\sfcont.dll O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe Thanks :) |
The_End_Of_Reality (334) | ||
| 448448 | 2006-04-22 08:12:00 | There's a lot of adware/malware on this system . I would get Search and Destroy ( . spybot . info/en/download/index . html" target="_blank">www . spybot . info) Download it install it, run it . And update it . This SHOULD pick up and let u delete the spyware / malware entries . Or go here ( . hijackthis . de/en" target="_blank">www . hijackthis . de) Tick the entries that say nasty . Then reboot . Then post another log . Some of the unknown entries may be nasty too . |
Speedy Gonzales (78) | ||
| 448449 | 2006-04-22 08:17:00 | also install a good antivirus and firewall. plenty of good free ones around so theres no excuse ! | tweak'e (69) | ||
| 448450 | 2006-04-22 08:57:00 | Speedy - Thanks, I will do both and repost the log file again. tweak'e - I know, I will DL AVG free and install that, also a free firewall... I am not sure when I will be able to do these but it is a priority. |
The_End_Of_Reality (334) | ||
| 448451 | 2006-04-22 09:46:00 | I would also download the trial version of Ewido Security Suite (www.ewido.net) When installing, under "Additional Options" uncheck "Install Background Guard" and "Install scan via context menu". Launch Ewido Security Suite (there should be an icon on your desktop doubleclick it). The program will now go to the main screen. You will need to update ewido to the latest definition files. On the left hand side of the main screen click update and then click on Start Update. The update will start and a progress bar will show the updates being installed. If you have problems with the updater, you can use this link to manually update ewido. www.ewido.net Do not run a scan yet. When you have done this, boot into Safe Mode (restart your PC and keep tapping F8 while it restarts). Run Ewido Security Suite now. Click on Scanner and click Complete System Scan and the scan will begin. During the scan it will prompt you to clean files, click OK. When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK. When the scan is finished, click the Save report button at the bottom of the screen. Save the report to your desktop and close Ewido Security Suite.Please post its log here. ================================== I would also treat P2P Networking as a seperate uninstall as it has a few hidden files.. Click Here to download KillBox (www.downloads.subratam.org) Extract the program to your desktop and double-click on its folder, then double-click on Killbox.exe to start the program. In the killbox program, select the Delete on Reboot option. Copy the file names below to the clipboard by highlighting them and pressing Control-C: C:\Program Files\MsConfigs\MsConfigs.exe C:\WINDOWS\system32\p2pnetwork.exe C:\WINDOWS\system32\CMD.COM C:\WINDOWS\system32\netstat.com C:\WINDOWS\system32\ping.com C:\WINDOWS\system32\regedit.com C:\WINDOWS\system32\tasklist.com C:\WINDOWS\system32\taskkill.com C:\WINDOWS\system32\taskmgr.com C:\WINDOWS\system32\tracert.com Return to Killbox, go to the File menu, and choose "Paste from Clipboard". Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt. |
Pancake (6359) | ||
| 448452 | 2006-04-22 09:57:00 | First thing I'd do is get rid of Kazaa, thats a big cause of spyware being installed on that computer. | bob_doe_nz (92) | ||
| 448453 | 2006-04-22 10:00:00 | Thanks Pancake, I am DLing Ewido now... With the Killbox, ticking these C:\Program Files\MsConfigs\MsConfigs.exe C:\WINDOWS\system32\p2pnetwork.exe C:\WINDOWS\system32\CMD.COM C:\WINDOWS\system32\netstat.com C:\WINDOWS\system32\ping.com C:\WINDOWS\system32\regedit.com C:\WINDOWS\system32\tasklist.com C:\WINDOWS\system32\taskkill.com C:\WINDOWS\system32\taskmgr.com C:\WINDOWS\system32\tracert.com The likes of taskmgr.com, tracert.com, etc these are DOS apps am I right? What does it do to them? First thing I'd do is get rid of Kazaa, thats a big cause of spyware being installed on that computer. Yes, I will, I know that is a big problem, I told her it is bad and that I will uninstall it |
The_End_Of_Reality (334) | ||
| 448454 | 2006-04-22 10:11:00 | The likes of taskmgr.com, tracert.com, etc these are DOS apps am I right? What does it do to them They are put there by P2P Networking and KillBox will delete them for you. |
Pancake (6359) | ||
| 448455 | 2006-04-22 10:20:00 | So deleting them will have no effect whatso ever on the PC as in the DOS side of it and stuff? | The_End_Of_Reality (334) | ||
| 448456 | 2006-04-22 10:53:00 | So deleting them will have no effect whatso ever on the PC as in the DOS side of it and stuff? None at all |
Pancake (6359) | ||
| 1 2 3 | |||||