Computer Help Forums
Home Register Members Search Articles Gallery Arcade Links
Member Login:

Computer Help Forum > Operating Systems > System Security & Infection Support > hijack this log

Notices


Reply
Thread Tools Display Modes

hijack this log

 
 
Madison Parks
Join Date: Apr 2004
Location: US
Age: 20
Posts: 1,230
TheOneGreatX's Avatar

TheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to behold
 
      Dec 20th, 04, 8:45 PM


Logfile of HijackThis v1.98.2
Scan saved at 2:44:33 PM, on 12/20/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Stardock\SDMCP.exe
C:\PROGRA~1\VCOM\SYSTEM~1\MXTask.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\VCOM\SYSTEM~1\mxtask.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\AOpen\Mouse\Amoumain.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\WINDOWS\system32\ctfmon.exe
C:\program files\valve\steam\steam.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mim.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\Program Files\AOpen\SilentTek\HardwareMonitor.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://nimrodonline.dhs.org
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [HardwareMonitor] C:\Program Files\AOpen\SilentTek\RegInformation.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [MimBoot] C:\Program Files\Musicmatch\Musicmatch Jukebox\mimboot.exe
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\AOpen\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Hijacked Internet access by New.Net
O10 - Broken Internet access because of LSP provider 'xfire_lsp.dll' missing
O15 - Trusted Zone: *.musicmatch.com
 
Reply With Quote
 
Assistant Sensei
Join Date: Aug 2004
Location: VA & NC
Age: 24
Posts: 1,162
D Schrute's Avatar

D Schrute is a splendid one to beholdD Schrute is a splendid one to beholdD Schrute is a splendid one to beholdD Schrute is a splendid one to beholdD Schrute is a splendid one to beholdD Schrute is a splendid one to behold
 
      Dec 20th, 04, 10:14 PM
O10 - Hijacked Internet access by New.Net
 

 
"I can travel anywhere, except Cuba, and I will travel to New Zealand and walk the Lord of the Rings trail to Mordor and I will hike Mount Doom." ~Dwight K. Schrute
Reply With Quote
 
Addicted to THQ
Join Date: Apr 2003
Location: Ann Arbor, Mi
Age: 26
Posts: 2,925
Fenis-Wolf's Avatar

Fenis-Wolf has much to be proud of his / her geeknessFenis-Wolf has much to be proud of his / her geeknessFenis-Wolf has much to be proud of his / her geeknessFenis-Wolf has much to be proud of his / her geeknessFenis-Wolf has much to be proud of his / her geeknessFenis-Wolf has much to be proud of his / her geeknessFenis-Wolf has much to be proud of his / her geeknessFenis-Wolf has much to be proud of his / her geeknessFenis-Wolf has much to be proud of his / her geekness
 
      Dec 20th, 04, 11:50 PM
Check these bad boys: (However-note that New.net can be a bear to get removed so after you fix these, reboot into safe mode and run AdAware)
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [MimBoot] C:\Program Files\Musicmatch\Musicmatch Jukebox\mimboot.exe
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\AOpen\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Hijacked Internet access by New.Net
O10 - Broken Internet access because of LSP provider 'xfire_lsp.dll' missing
O15 - Trusted Zone: *.musicmatch.com
 
Reply With Quote
 
Madison Parks
Join Date: Apr 2004
Location: US
Age: 20
Posts: 1,230
TheOneGreatX's Avatar

TheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to behold
 
      Dec 24th, 04, 12:24 AM
um, i tried doing all that, but they're still there, and now there's more
heres the new log:

Logfile of HijackThis v1.98.2
Scan saved at 6:24:25 PM, on 12/23/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\VCOM\SYSTEM~1\MXTask.exe
C:\PROGRA~1\VCOM\SYSTEM~1\mxtask.exe
C:\Program Files\Common Files\Stardock\SDMCP.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\PROGRA~1\AOpen\Mouse\Amoumain.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\WINDOWS\system32\ctfmon.exe
C:\program files\valve\steam\steam.exe
C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
C:\Program Files\AOpen\SilentTek\HardwareMonitor.exe
C:\Program Files\Internet Explorer\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\WINDOWS\system32\rundll32.exe
C:\firefox\firefox.exe
C:\Program Files\AIM\aim.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://minisearch.startnow.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://minisearch.startnow.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://minisearch.startnow.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://minisearch.startnow.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://minisearch.startnow.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://minisearch.startnow.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://minisearch.startnow.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://minisearch.startnow.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://minisearch.startnow.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://minisearch.startnow.com/
R3 - URLSearchHook: HyperSearchHook - {02527A62-9BA8-4B5E-B483-EF934AEC025F} - C:\Program Files\Common Files\Hyperbar\HyperbarSS3.dll
O4 - HKLM\..\Run: [HardwareMonitor] C:\Program Files\AOpen\SilentTek\RegInformation.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\AOpen\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [multi build knob clock] C:\Documents and Settings\All Users.WINDOWS\Application Data\Itch Readme Multi Build\third bags.exe
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKCU\..\Run: [Error ref] C:\DOCUME~1\GORDON~1.THE\APPLIC~1\TITLEM~1\tons joy.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
 
Reply With Quote
 
Addicted to THQ
Join Date: Apr 2003
Location: Ann Arbor, Mi
Age: 26
Posts: 2,925
Fenis-Wolf's Avatar

Fenis-Wolf has much to be proud of his / her geeknessFenis-Wolf has much to be proud of his / her geeknessFenis-Wolf has much to be proud of his / her geeknessFenis-Wolf has much to be proud of his / her geeknessFenis-Wolf has much to be proud of his / her geeknessFenis-Wolf has much to be proud of his / her geeknessFenis-Wolf has much to be proud of his / her geeknessFenis-Wolf has much to be proud of his / her geeknessFenis-Wolf has much to be proud of his / her geekness
 
      Dec 24th, 04, 2:42 AM
Check these, and click 'Fix'. I'd also get AdAware, and update it then run it from Safe Mode.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://minisearch.startnow.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://minisearch.startnow.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://minisearch.startnow.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://minisearch.startnow.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://minisearch.startnow.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://minisearch.startnow.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://minisearch.startnow.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://minisearch.startnow.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://minisearch.startnow.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://minisearch.startnow.com/
R3 - URLSearchHook: HyperSearchHook - {02527A62-9BA8-4B5E-B483-EF934AEC025F} - C:\Program Files\Common Files\Hyperbar\HyperbarSS3.dll
O4 - HKLM\..\Run: [HardwareMonitor] C:\Program Files\AOpen\SilentTek\RegInformation.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtim
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\AOpen\Mouse\Amoumain.exe
O4 - HKLM\..\Run: [multi build knob clock] C:\Documents and Settings\All Users.WINDOWS\Application Data\Itch Readme Multi Build\third bags.exe
O4 - HKCU\..\Run: [Error ref] C:\DOCUME~1\GORDON~1.THE\APPLIC~1\TITLEM~1\tons joy.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
 
Reply With Quote
 
Madison Parks
Join Date: Apr 2004
Location: US
Age: 20
Posts: 1,230
TheOneGreatX's Avatar

TheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to behold
 
      Dec 24th, 04, 4:56 AM
i ran adaware, it didnt do anything
 
Reply With Quote
 
Madison Parks
Join Date: Apr 2004
Location: US
Age: 20
Posts: 1,230
TheOneGreatX's Avatar

TheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to beholdTheOneGreatX is a splendid one to behold
 
      Dec 30th, 04, 1:31 AM
ok, i fixed it
it turns out that the spyware told spybot s&d not to look for it, so i just re-enabled the search for it and lo and behold! there it was
 
Reply With Quote
Reply

« HijackThis Log | recurring viruses plz help!!! »
Thread Tools
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
HiJack Log Phil System Security & Infection Support 4 Sep 25th, 06 9:48 PM
Hijack this log Yoda System Security & Infection Support 8 Apr 21st, 06 10:41 AM
can anyone look at my hijack please? error1872 System Security & Infection Support 2 Dec 19th, 05 9:52 AM
Hijack This log - could someone help please? karansaraf System Security & Infection Support 4 Jan 1st, 05 4:11 PM
Hijack This Log Bubba Gump System Security & Infection Support 5 Aug 16th, 04 10:34 AM


Powered by vBulletin® Version. Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
SEO by vBSEO 3.3.2 ©2009, Crawlability, Inc.
Contact Us - Computer Help Forum - Sitemap - Privacy Statement - Top

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35