| View previous topic :: View next topic |
| Author |
Message |
Luigi
Grandmaster Cheater Supreme
 Reputation: 1
Joined: 24 Mar 2008
Posts: 1082
|
 Posted: Sun May 24, 2009 11:20 am Post subject: HijackThis log for my crappy computer |
 |
|
I am using my other computer which has experienced problems for a while
Here's a log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:13:54 PM, on 5/24/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Digital Media Reader\readericon45G.exe
C:\WINDOWS\zHotkey.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Registry Mechanic\RegMech.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\WINDOWS\system32\wuauclt.exe
G:\aswclnr.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\aswclnr.tmp
G:\Norman\Norman_Malware_Cleaner.exe
G:\HiJackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.gateway.com/g/sidepanel.html?Ch=Retail&Br=EM&Loc=ENG_US&Sys=DTP&M=T6544
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch=Retail&Br=EM&Loc=ENG_US&Sys=DTP&M=T6544
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.html?Ch=Retail&Br=EM&Loc=ENG_US&Sys=DTP&M=T6544
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-21-2511621018-3331317201-1811221232-1006\..\Run: [Power2GoExpress] NA (User 'Owner')
O4 - HKUS\S-1-5-21-2511621018-3331317201-1811221232-1006\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Owner')
O4 - HKUS\S-1-5-21-2511621018-3331317201-1811221232-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Owner')
O4 - HKUS\S-1-5-21-2511621018-3331317201-1811221232-1006\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Owner')
O4 - HKUS\S-1-5-21-2511621018-3331317201-1811221232-1008\..\Run: [Power2GoExpress] NA (User 'Zachary')
O4 - HKUS\S-1-5-21-2511621018-3331317201-1811221232-1008\..\Run: [Clicky Gone] G:\ClickyGonePortable\App\ClickyGone.exe (User 'Zachary')
O4 - HKUS\S-1-5-21-2511621018-3331317201-1811221232-1008\..\Run: [rusagenito] Rundll32.exe "C:\WINDOWS\system32\hafalahu.dll",s (User 'Zachary')
O4 - HKUS\S-1-5-21-2511621018-3331317201-1811221232-1008\..\Run: [cc895f91] rundll32.exe "C:\WINDOWS\system32\zatitohi.dll",b (User 'Zachary')
O4 - HKUS\S-1-5-21-2511621018-3331317201-1811221232-1008\..\Run: [CPMcfba6c0d] Rundll32.exe "C:\WINDOWS\system32\regoyivu.dll",a (User 'Zachary')
O4 - HKUS\S-1-5-21-2511621018-3331317201-1811221232-501\..\Run: [Power2GoExpress] NA (User 'Guest')
O4 - Global Startup: ZDWLan Utility.lnk = C:\Program Files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
--
End of file - 9429 bytes
|
|
| Back to top |
|
 |
SF
I'm a spammer
 Reputation: 119
Joined: 19 Mar 2007
Posts: 6028
|
| Posted: Sun May 24, 2009 11:59 am Post subject: |
|
|
First...what's the problem with your PC?
If it's performance...try turning off some start up applications. (Start->run->msconfig->startup tab)
_________________
|
|
| Back to top |
|
|
Luigi
Grandmaster Cheater Supreme
Reputation: 1
Joined: 24 Mar 2008
Posts: 1082
|
| Posted: Sun May 24, 2009 1:27 pm Post subject: |
|
|
| SF wrote: | First...what's the problem with your PC?
If it's performance...try turning off some start up applications. (Start->run->msconfig->startup tab) |
Viruses (which are being cleaned as we speak), internet is EXTREMELY slow but on the same network as my computer, which is pretty fast, everything takes 10 minutes to load... so on. Its a prebuilt Windows XP Media Center SP3 with some pretty good parts.
I have done:
- Defragged
- Defragged registry
- Multiple spyware and virus scans
- Many network settings
- Checked through firewalls to see if anything necessary was blocked
|
|
| Back to top |
|
|
hcavolsdsadgadsg
I'm a spammer
![]() Reputation: 26
Joined: 11 Jun 2007
Posts: 5801
|
| Posted: Sun May 24, 2009 2:56 pm Post subject: |
|
|
| If you're infected with shit, just flatten and reinstall windows. No point in taking risks of shit still being there.
|
|
| Back to top |
|
|
SF
I'm a spammer
Reputation: 119
Joined: 19 Mar 2007
Posts: 6028
|
| Posted: Sun May 24, 2009 3:29 pm Post subject: |
|
|
In another thread, you said you formatted 2 days ago. Did you get infected within 2 days? ._.
_________________
|
|
| Back to top |
|
|
Madman
I post too much
 Reputation: 1
Joined: 04 May 2006
Posts: 3978
|
| Posted: Sun May 24, 2009 4:13 pm Post subject: |
|
|
Hold up. You're still connected to the network which is connected to other computers?
Smart laddy.
_________________
|
|
| Back to top |
|
|
Timmah
I post too much
 Reputation: 0
Joined: 23 Nov 2008
Posts: 2405
Location: Here but not over there, There but somewhere
|
| Posted: Mon May 25, 2009 8:55 am Post subject: |
|
|
| Madman wrote: | Hold up. You're still connected to the network which is connected to other computers?
Smart laddy. |
@Continue From Above
It's always a good idea to disconnect other computers, because the virus may spread..
_________________
|
|
| Back to top |
|
|
Strathe
Grandmaster Cheater
![]() Reputation: 0
Joined: 16 Aug 2006
Posts: 700
Location: Middle of nowhere.
|
| Posted: Mon May 25, 2009 9:45 am Post subject: |
|
|
| Quote: | O4 - HKUS\S-1-5-21-2511621018-3331317201-1811221232-1008\..\Run: [Clicky Gone] G:\ClickyGonePortable\App\ClickyGone.exe (User 'Zachary')
O4 - HKUS\S-1-5-21-2511621018-3331317201-1811221232-1008\..\Run: [rusagenito] Rundll32.exe "C:\WINDOWS\system32\hafalahu.dll",s (User 'Zachary')
O4 - HKUS\S-1-5-21-2511621018-3331317201-1811221232-1008\..\Run: [cc895f91] rundll32.exe "C:\WINDOWS\system32\zatitohi.dll",b (User 'Zachary')
O4 - HKUS\S-1-5-21-2511621018-3331317201-1811221232-1008\..\Run: [CPMcfba6c0d] Rundll32.exe "C:\WINDOWS\system32\regoyivu.dll",a (User 'Zachary') |
Those look weird..
But i don't know shit about it.
As said above, just reformat/reinstall, but reinstall the very least.
Just set the basic stuff to get the internet and see if it still lags or not.
|
|
| Back to top |
|
|
Luigi
Grandmaster Cheater Supreme
Reputation: 1
Joined: 24 Mar 2008
Posts: 1082
|
| Posted: Mon May 25, 2009 6:42 pm Post subject: |
|
|
| SF wrote: | | In another thread, you said you formatted 2 days ago. Did you get infected within 2 days? ._. |
This is a different computer, in fact my brother's.
|
|
| Back to top |
|
|
Saifallofjmr
Grandmaster Cheater Supreme
![]() Reputation: 4
Joined: 02 Apr 2007
Posts: 1450
|
| Posted: Thu May 28, 2009 10:59 pm Post subject: |
|
|
I spotted nothing abnormal with this log, if you are still paranoid google and install "Malawarebyte's Anti Malware" and run a scan (full).
Also try using eset.
_________________
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
