Antivirus Protection
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me
Go Back   Dev Shed Forums > System Administration > Antivirus Protection
Reload this Page

Please Help! *hijack This Log Posted*

Discuss Please Help! *hijack This Log Posted* in the Antivirus Protection forum on Dev Shed.
Please Help! *hijack This Log Posted* Antivirus Protection forum discussing issues relating to antivirus programs, spyware, hijack protection, and personal firewalls for all operating systems. Keep your systems protected from hackers and other hazards.

Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
« Previous Thread | Next Thread »  
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
  #1  
Old May 25th, 2005, 03:33 PM
Emma1984 Emma1984 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: May 2005
Posts: 2 Emma1984 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 8 m 11 sec
Reputation Power: 0
Unhappy Please Help! *hijack This Log Posted*
I have recently brought a computer second hand and unfortunately it looks to be drowning in spyware and stuff......

I have posted the hijack this log below and would appreciate if someone could help me in clearing out the bits that are not needed on my PC.

The bearshare is a programme that i have added and i know that is subject to some spyware but is there anything here that could be the root cause of my slow PC??

Thanks in advance

Emma

Logfile of HijackThis v1.99.1
Scan saved at 21:22:00, on 25/05/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Trend Micro\Internet Security\tmproxy.exe
C:\Program Files\Trend Micro\Internet Security\PccPfw.exe
C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\keyhook.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Trend Micro\Internet Security\pccguide.exe
C:\Program Files\Trend Micro\Internet Security\PCClient.exe
C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe
C:\Program Files\BearShare\BearShare.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HbTools\Bin\4.6.2.0\HbtOEAddOn.exe
C:\Program Files\HbTools\Bin\4.6.2.0\HbtWeatherOnTray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\AIM\aim.exe
C:\WINDOWS\system32\sistray.exe
C:\Program Files\blueyonder IST\bin\mpbtn.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HbTools\Bin\4.6.2.0\HbtSrv.exe
C:\DOCUME~1\emma\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://web.zksxsiwvykxjcitcmiimbz.com/yoKkNSQqLPaPIAQ6nltrYJJenHqflpsvjKYkBY5xxFUa1gEyTJCwA2H_oB6SaUEX.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.netscape.co.uk
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.q-serve.com/signup.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by blueyonder
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {1EA41F80-B61F-69AF-FA61-9EAF009A408D} - C:\DOCUME~1\emma\APPLIC~1\METAFA~1\RDRMESS.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: HbTools - {74CC49F7-EB32-4A08-B204-948962A6E3DB} - C:\Program Files\HbTools\Bin\4.6.2.0\HbtHostIE.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: H&otbar - {74CC49F7-EB32-4A08-B204-948962A6E3DB} - C:\Program Files\HbTools\Bin\4.6.2.0\HbtHostIE.dll
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security\pccguide.exe"
O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro\Internet Security\PCClient.exe"
O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe" /run
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-us\msnappau.exe"
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SexNow] C:\WINDOWS\SexNow.exe -n
O4 - HKLM\..\Run: [BALL COOL DEBUG AXIS] C:\Documents and Settings\All Users\Application Data\oozeblueballcool\acidbody.exe
O4 - HKLM\..\Run: [HbTools] C:\Program Files\HbTools\Bin\4.6.2.0\HbtOEAddOn.exe
O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\HbTools\Bin\4.6.2.0\HbtWeatherOnTray.exe
O4 - HKLM\..\Run: [podzcbte] C:\WINDOWS\system32\ivvjsvvl.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [KEEPNURB] C:\DOCUME~1\emma\APPLIC~1\STYLET~1\log jugs.exe
O4 - HKCU\..\Run: [Registry Cleaner] "C:\Program Files\Registry Cleaner Trial\RegClean.exe"
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: blueyonder Instant Support Tool.lnk = C:\Program Files\blueyonder IST\bin\matcli.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O23 - Service: Trend Micro Personal Firewall (PccPfw) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Internet Security\PccPfw.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Incorporated. - C:\Program Files\Trend Micro\Internet Security\tmproxy.exe
Reply With Quote
  #2  
Old May 25th, 2005, 03:55 PM
LinuxPenguin's Avatar
LinuxPenguin LinuxPenguin is offline
fork while true;
Dev Shed God 1st Plane (5500 - 5999 posts)
  
Join Date: May 2005
Location: England, UK
Posts: 5,535 LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)  Folding Points: 11590 Folding Title: Novice Folder
Time spent in forums: 1 Month 3 Weeks 1 Day 19 h 30 m 28 sec
Reputation Power: 1008
<snipped by self>
Reply With Quote
  #3  
Old May 25th, 2005, 05:11 PM
Emma1984 Emma1984 is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: May 2005
Posts: 2 Emma1984 User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 8 m 11 sec
Reputation Power: 0
Quote:
Originally Posted by LinuxPenguin
In answer, bearshare is probably the root cause. It installs an awful lot of spyware...

Please remove these entries

C:\Program Files\HbTools\Bin\4.6.2.0\HbtOEAddOn.exe
C:\Program Files\HbTools\Bin\4.6.2.0\HbtWeatherOnTray.exe
C:\Program Files\HbTools\Bin\4.6.2.0\HbtSrv.exe
O2 - BHO: (no name) - {1EA41F80-B61F-69AF-FA61-9EAF009A408D} - C:\DOCUME~1\emma\APPLIC~1\METAFA~1\RDRMESS.exe
O2 - BHO: HbTools - {74CC49F7-EB32-4A08-B204-948962A6E3DB} - C:\Program Files\HbTools\Bin\4.6.2.0\HbtHostIE.dll

Edit: Sorry, missed some out

O4 - HKLM\..\Run: [SexNow] C:\WINDOWS\SexNow.exe -n
O4 - HKLM\..\Run: [BALL COOL DEBUG AXIS] C:\Documents and Settings\All Users\Application Data\oozeblueballcool\acidbody.exe
O4 - HKLM\..\Run: [HbTools] C:\Program Files\HbTools\Bin\4.6.2.0\HbtOEAddOn.exe
O4 - HKLM\..\Run: [podzcbte] C:\WINDOWS\system32\ivvjsvvl.exe
O4 - HKLM\..\Run: [WeatherOnTray] C:\Program Files\HbTools\Bin\4.6.2.0\HbtWeatherOnTray.exe
O4 - HKCU\..\Run: [KEEPNURB] C:\DOCUME~1\emma\APPLIC~1\STYLET~1\log jugs.exe


Hi - this is Emmas sister Lisa - Emma says to say thanks and as soon as shes removed these files she'll post her log again!

Thanks VERY much!
Reply With Quote
  #4  
Old May 25th, 2005, 05:23 PM
LinuxPenguin's Avatar
LinuxPenguin LinuxPenguin is offline
fork while true;
Dev Shed God 1st Plane (5500 - 5999 posts)
  
Join Date: May 2005
Location: England, UK
Posts: 5,535 LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)LinuxPenguin User rank is General (90000 - 100000 Reputation Level)  Folding Points: 11590 Folding Title: Novice Folder
Time spent in forums: 1 Month 3 Weeks 1 Day 19 h 30 m 28 sec
Reputation Power: 1008
<snipped by self>
Reply With Quote
  #5  
Old May 25th, 2005, 05:46 PM
oneMSBi's Avatar
oneMSBi oneMSBi is offline
CAUTION: Loderator Moose
Dev Shed Loyal (3000 - 3499 posts)
  
Join Date: Nov 2004
Location: some starry place (india)
Posts: 3,431 oneMSBi User rank is First Lieutenant (10000 - 20000 Reputation Level)oneMSBi User rank is First Lieutenant (10000 - 20000 Reputation Level)oneMSBi User rank is First Lieutenant (10000 - 20000 Reputation Level)oneMSBi User rank is First Lieutenant (10000 - 20000 Reputation Level)oneMSBi User rank is First Lieutenant (10000 - 20000 Reputation Level)oneMSBi User rank is First Lieutenant (10000 - 20000 Reputation Level)oneMSBi User rank is First Lieutenant (10000 - 20000 Reputation Level)oneMSBi User rank is First Lieutenant (10000 - 20000 Reputation Level) 
Time spent in forums: 4 Weeks 1 Day 21 h 34 m 19 sec
Reputation Power: 156
Emma or Lisa, please download the following software from the site next to them. Install them and run them as soon as possible. Then please unzip hijackthis to a permanent folder and run the scan again. Please post a fresh hijackthis log here.

Adaware from here: http://www.lavasoftusa.com/software/adaware/

Spybot Search and Destroy from here :http://www.safer-networking.org/

================================================================
__________________
Nigel
..Seeking code free nirvana...
Nigel Fernandes Blog
Never argue with fools. They will bring you down to their level and beat you with experience.

Manchester United Forever
Last edited by oneMSBi : May 25th, 2005 at 05:56 PM.
Reply With Quote
  #6  
Old May 31st, 2005, 11:16 PM
Tom Myboy Tom Myboy is offline
Contributing User
Dev Shed Regular (2000 - 2499 posts)
  
Join Date: Aug 2003
Posts: 2,491 Tom Myboy User rank is Sergeant (500 - 2000 Reputation Level)Tom Myboy User rank is Sergeant (500 - 2000 Reputation Level)Tom Myboy User rank is Sergeant (500 - 2000 Reputation Level)Tom Myboy User rank is Sergeant (500 - 2000 Reputation Level)Tom Myboy User rank is Sergeant (500 - 2000 Reputation Level) 
Time spent in forums: 3 Days 20 h 13 m 41 sec
Reputation Power: 14
Hii Emma1984,

Adaware and Spybot are not always effective with a LOP infection. Besides, MessengerPlus will just reinstall them if the problem is not dealt with at the source.

I also see at least one porn dialer in your previous log.

Please post a fresh HijackThis log.

Tom
__________________
HijackThis
Ad-aware
Spybot Search & Destroy
SpywareBlaster
SpywareGuard
Housecall Online A/V Scan
Please read the stickys at the top of the forum before posting!
Reply With Quote
Reply

Viewing: Dev Shed Forums > System Administration > Antivirus Protection > Please Help! *hijack This Log Posted*

« Previous Thread | Next Thread »

Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Linear Mode Linear Mode
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump


Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 





© 2003-2008 by Developer Shed. All rights reserved. DS Cluster 3 hosted by Hostway.