| View previous topic :: View next topic |
| Author |
Message |
Moments
Grandmaster Cheater Supreme
![]() Reputation: 17
Joined: 20 Mar 2008
Posts: 1196
|
 Posted: Thu Jan 01, 2009 8:11 pm Post subject: Hijack this log |
 |
|
| Code: | C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\AppRanger\SWTray.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=101760&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Hotspot Shield Toolbar - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Program Files\Hotspot_Shield\tbHot1.dll
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,userinit.exe,
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - (no file)
O2 - BHO: SITEguard BHO - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - C:\Program Files\STOPzilla!\SZSG.dll
O2 - BHO: AppRanger IE Sandbox - {1ec7abb1-e555-404b-901c-6d24af4ce44d} - C:\Program Files\AppRanger\TSBoxIE.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: MSIEPlugin - {4B0FAF5A-67C4-4625-AE07-B0DBADA16EBF} - C:\Documents and Settings\All Users\Application Data\uPlayMe\plugins\MSIE.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Hotspot Shield Toolbar - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Program Files\Hotspot_Shield\tbHot1.dll
O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dll
O3 - Toolbar: Hotspot Shield Toolbar - {c95a4e8e-816d-4655-8c79-d736da1adb6d} - C:\Program Files\Hotspot_Shield\tbHot1.dll
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\SZSG.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SWTray] C:\Program Files\AppRanger\SWTray.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCfox000
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase6662.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
O16 - DPF: {BD08A9D5-0E5C-4F42-99A3-C0CB5E860557} (CSolidBrowserObj Object) - http://cdn1.acclaimdownloads.com/solidstateion.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AppRanger Service (apprngr_svc) - AppRanger, Inc. - C:\Program Files\AppRanger\SWSvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: DNADownloader - CNET Networks - C:\Program Files\GameSpot\DownloadManager_Win32.exe |
Whats wrong? I has viruses D:
|
|
| Back to top |
|
 |
Sora
Grandmaster Cheater Supreme
 Reputation: 0
Joined: 14 May 2008
Posts: 1471
|
| Posted: Thu Jan 01, 2009 8:46 pm Post subject: |
|
|
| STOPzilla is malware.
|
|
| Back to top |
|
|
iTz SWAT
I post too much
 Reputation: 1
Joined: 20 Dec 2007
Posts: 2227
Location: Me.Location;
|
| Posted: Thu Jan 01, 2009 10:19 pm Post subject: |
|
|
| Sora wrote: | | STOPzilla is malware. |
I'm not sure about that one but Mcafee Site Advisor is giving it the secure logo not just the green tick lol
_________________
|
|
| Back to top |
|
|
Mozilla Firefox
Grandmaster Cheater Supreme
 Reputation: 0
Joined: 06 Feb 2007
Posts: 1250
|
| Posted: Thu Jan 01, 2009 10:29 pm Post subject: |
|
|
Yes, you DO have viruses!
Your Registry Editor seems to be disabled! Fix it!
| Code: | | O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 |
Delete these useless entries:
| Code: | | O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZCfox000 |
| Code: | Unknown
O16 - DPF: {BD08A9D5-0E5C-4F42-99A3-C0CB5E860557} (CSolidBrowserObj Object) - http://cdn1.acclaimdownloads.com/solidstateion.cab |
| Code: | | O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) |
| Code: | O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - (no file)
|
Delete the same 6 entries below:
| Code: | O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dll
|
After you have completed the above, download Spybot Search & Destroy and do a full scan to check for remaining issues with the current viruses. Hope this helps regarding your issue! 
|
|
| Back to top |
|
|
Frostbyt3
Master Cheater
 Reputation: 0
Joined: 07 Jan 2008
Posts: 323
Location: Australia
|
| Posted: Thu Jan 01, 2009 11:25 pm Post subject: |
|
|
| Mozilla Firefox wrote: | Yes, you DO have viruses!
Your Registry Editor seems to be disabled! Fix it!
| Code: | | O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 |
|
Since I had this issue aswell on my sisters pc, how the hell would he fix that key if his registry editor is disabled?
|
|
| Back to top |
|
|
Mozilla Firefox
Grandmaster Cheater Supreme
Reputation: 0
Joined: 06 Feb 2007
Posts: 1250
|
| Posted: Thu Jan 01, 2009 11:47 pm Post subject: |
|
|
| Frostbyt3 wrote: | | Mozilla Firefox wrote: | Yes, you DO have viruses!
Your Registry Editor seems to be disabled! Fix it!
| Code: | | O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 |
|
Since I had this issue aswell on my sisters pc, how the hell would he fix that key if his registry editor is disabled? |
Change the value of the registry entry "DisableRegedit" from "1" to "0"; obviously. 
|
|
| Back to top |
|
|
Frostbyt3
Master Cheater
Reputation: 0
Joined: 07 Jan 2008
Posts: 323
Location: Australia
|
| Posted: Thu Jan 01, 2009 11:50 pm Post subject: |
|
|
| Mozilla Firefox wrote: | | Frostbyt3 wrote: | | Mozilla Firefox wrote: | Yes, you DO have viruses!
Your Registry Editor seems to be disabled! Fix it!
| Code: | | O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 |
|
Since I had this issue aswell on my sisters pc, how the hell would he fix that key if his registry editor is disabled? |
Change the value of the registry entry "DisableRegedit" from "1" to "0"; obviously. |
Using what registry editor? =\ Don't mean to be rude but I need this help too.
|
|
| Back to top |
|
|
superweapons
Grandmaster Cheater Supreme
 Reputation: 2
Joined: 04 Jan 2008
Posts: 1355
Location: The Internet. Where else?
|
| Posted: Thu Jan 01, 2009 11:52 pm Post subject: |
|
|
| Mozilla Firefox wrote: | | Frostbyt3 wrote: | | Mozilla Firefox wrote: | Yes, you DO have viruses!
Your Registry Editor seems to be disabled! Fix it!
| Code: | | O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 |
|
Since I had this issue aswell on my sisters pc, how the hell would he fix that key if his registry editor is disabled? |
Change the value of the registry entry "DisableRegedit" from "1" to "0"; obviously. |
Obviously, with registry editor (regedit) disabled, he cannot change the value. I would recommend a regedit fix, rather than doing it the manual way to reactivate regedit. You can run group policy editor (gpedit.msc) if you're really interested in doing it manually. But you'll probably have to do it in safe mode unless you're running XP Pro or Vista Ultimate. More information shouldn't be hard to find on Google.
_________________
|
|
| Back to top |
|
|
Mozilla Firefox
Grandmaster Cheater Supreme
Reputation: 0
Joined: 06 Feb 2007
Posts: 1250
|
| Posted: Fri Jan 02, 2009 12:03 am Post subject: |
|
|
| superweapons wrote: | | Mozilla Firefox wrote: | | Frostbyt3 wrote: | | Mozilla Firefox wrote: | Yes, you DO have viruses!
Your Registry Editor seems to be disabled! Fix it!
| Code: | | O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 |
|
Since I had this issue aswell on my sisters pc, how the hell would he fix that key if his registry editor is disabled? |
Change the value of the registry entry "DisableRegedit" from "1" to "0"; obviously. |
Obviously, with registry editor (regedit) disabled, he cannot change the value. I would recommend a regedit fix, rather than doing it the manual way to reactivate regedit. You can run group policy editor (gpedit.msc) if you're really interested in doing it manually. But you'll probably have to do it in safe mode unless you're running XP Pro or Vista Ultimate. More information shouldn't be hard to find on Google. |
Oops, my bad. 
| Frostbyt3 wrote: | | Mozilla Firefox wrote: | | Frostbyt3 wrote: | | Mozilla Firefox wrote: | Yes, you DO have viruses!
Your Registry Editor seems to be disabled! Fix it!
| Code: | | O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 |
|
Since I had this issue aswell on my sisters pc, how the hell would he fix that key if his registry editor is disabled? |
Change the value of the registry entry "DisableRegedit" from "1" to "0"; obviously. |
Using what registry editor? =\ Don't mean to be rude but I need this help too. |
Sorry, my bad. Although, yes, you can try to use the Group Policy Editor (gpedit.msc). Go to -> Start -> Run -> Type in 'gpedit.msc' -> User Configuration -> Administrative Templates -> System -> "Prevent access to registry editing tools" -> Click 'Disabled' -> OK -> Restart Computer
I accidentally mentioned that actually; because really HijackThis should be able to fix it since there's a "Fix" option, so try that.
|
|
| Back to top |
|
|
Mysterious
Grandmaster Cheater Supreme
![]() Reputation: 0
Joined: 26 Jun 2006
Posts: 1421
|
| Posted: Fri Jan 02, 2009 12:28 am Post subject: |
|
|
What site / virus scanner for logs ? i wanna try this
_________________
|
|
| Back to top |
|
|
Mozilla Firefox
Grandmaster Cheater Supreme
Reputation: 0
Joined: 06 Feb 2007
Posts: 1250
|
| Posted: Fri Jan 02, 2009 12:30 am Post subject: |
|
|
| run3500 wrote: | | What site / virus scanner for logs ? i wanna try this |
It's stated in the thread title; but anyways, it's called 'HijackThis'.
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
