|
|
|||||||||
|
|||||||||
| |||||||||
|
|
|
| |||||||||
![]() |
|
|
«
Previous Thread
|
Next Thread
»
|
Thread Tools | Search this Thread | Rate Thread | Display Modes |
|
#1
|
|||
|
|||
|
hijackthis LOG: please tell me what needs to go!
Hi all, my desktop picture has been hijacked, and replaced or rather overlapped by a warning page promoting some program. Likewise, my browser homepage was also hijacked, and now only opens up to a blank homepage.
I have run both adaware and cwshredder with no success. Here is my HIJACKthis LOG: Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\SealedMedia\sealmon.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe C:\WINDOWS\System32\mshelp32.exe C:\WINDOWS\System32\cmd32.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\AIM\aim.exe C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe C:\Program Files\FinePixViewer\QuickDCF.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Panda Software\Panda Antivirus Platinum\AVENGINE.EXE C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Panda Software\Panda Antivirus Platinum\pavProxy.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\iTunes\iTunes.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\HijackThis\HijackThis.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm O2 - BHO: (no name) - {A708A39C-8DA7-4e36-B3B0-0A1FFAFD4B6D} - C:\WINDOWS\system32\javafix3.dll O2 - BHO: AntiSpyware Class - {FD8953C6-823F-46ab-8669-3B2BBF3A9210} - C:\WINDOWS\System32\ash.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [EPSON Stylus C62 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S0BIC1.EXE /P23 "EPSON Stylus C62 Series" /O6 "USB001" /M "Stylus C62" O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Antivirus Platinum\Inicio.exe" O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE" /s O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe O4 - HKLM\..\Run: [sealmon] C:\Program Files\SealedMedia\sealmon.exe O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [mshelp32] C:\WINDOWS\System32\mshelp32.exe O4 - HKLM\..\Run: [ControlPanel] C:\WINDOWS\System32\cmd32.exe internat.dll,LoadKeyboardProfile O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [msjava critical update] c:\windows\jjfixer.exe O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe O4 - Global Startup: Image Transfer.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Exif Launcher.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab O23 - Service: AOL Connectivity Service - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Panda Firewall Service - Unknown - C:\Program Files\Panda Software\Panda Antivirus Platinum\Firewall\PavFires.exe O23 - Service: Panda anti-virus service - Unknown - C:\Program Files\Panda Software\Panda Antivirus Platinum\pavsrv51.exe O23 - Service: WAN Miniport (ATW) Service - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe THANK YOU FOR ANYONE WHO CAN HELP ME!!!! |
|
#2
|
|||
|
|||
|
Run HJT and scan and have it fix the following items:
C:\WINDOWS\System32\cmd32.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm O4 - Global Startup: Image Transfer.lnk = ? O4 - Global Startup: Exif Launcher.lnk = ? O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab Reboot the computer into Safe Mode (F8 while white bar goes across screen before seeing the Windows XP logo) and follow the instructions below to edit your registry: NOTE: I strongly recommend that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read this document, "How to make a backup of the Windows registry," for instructions. 1) Click Start, and then click Run. (The Run dialog box appears.) Type regedit then click OK. (The Registry Editor opens.) 2) Navigate to these registry keys: HKEY_CURRENT_USER\Software\Kazaa\LocalContent HKEY_CURRENT_USER\Software\iMesh\Client\LocalContent In the right pane, delete the values: Dir? 012345: %Windir%\Cache32 Navigate to the next registry keys and delete them: HKLMSoftwareMicrosoftWindowsCurrentVersionRun"CMD"="cmd32.exe" HKLMSoftwareMicrosoftWindowsCurrentVersionRunServices"CMD"= "cmd32.exe" HKCUSoftwareMicrosoftWindowsCurrentVersionRunOnce"CMD"= "cmd32.exe" HKLMSoftwareMicrosoftWindows"CMD"="cmd32.exe" HKLMSoftwareKrypton HKLMSoftwareMicrosoftWindows NTCurrentVersionWinlogon"Shell"= "explorer.exe %SYSTEM%cmd32.exe"] 3) Exit the Registry Editor Reboot your computer normally and run the two scans listed below; only one at a time; and have it fix anything it finds: Trend Micro Panda ActiveScan Once completed, run HijackThis, scan, and post a fresh log! ![]() Hopefully my plan of, "Removal in one post", works! ![]() |
![]() |
| Viewing: Dev Shed Forums > System Administration > Antivirus Protection > hijackthis LOG: please tell me what needs to go! |
| Thread Tools | Search this Thread |
| Display Modes | Rate This Thread |
|
|
|
|