Hijack This Log 1

[CaKiwi]

I have been cleaning up a friend's machine and this is the current Hijack This log. I would appreciate expert anaysis

Logfile of HijackThis v1.97.7
Scan saved at 2:03:27 PM, on 4/18/04
Platform: Windows NT 4 SP6 (WinNT 4.00.1381)
MSIE: Internet Explorer v5.51 SP2 (5.51.4807.2300)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\spoolss.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINNT\System32\nddeagnt.exe
C:\WINNT\Explorer.exe
C:\WINNT\System32\SysTray.Exe
C:\WINNT\System32\loadwc.exe
C:\PROGRA~1\HPCD-W~1\DirectCD\directcd.exe
C:\Program Files\HP CD-Writer\Mmenu\hpcdtray.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
G:\PROGRA~1\POPUPS~1\POP-UP~1\dpps2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINNT\System32\qttask.exe
C:\WINNT\System32\ddhelp.exe
C:\WINNT\system32\RpcSs.exe
C:\WINNT\system32\tcpsvcs.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\system32\tapisrv.exe
C:\WINNT\system32\rasman.exe
C:\WINNT\System32\pstores.exe
C:\WINNT\system32\MSTask.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Microsoft Office\Office\OSA.EXE
C:\QUICKENW\QWDLLS.EXE
C:\Download\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://my.netzero.net/s/search?r=minisearch

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

http://my.netzero.net/s/search?r=minisearch

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.hotmail.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://my.netzero.net/s/search?r=minisearch

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://www.cox.net

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://my.netzero.net/s/search?r=minisearch

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

http://my.netzero.net/s/search?r=minisearch

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Cox High Speed Internet
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =

http://my.netzero.net/s/search?r=minisearch

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: URLSearchHook Class - {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\Program Files\nzsearch\nzsearchenh.dll
F2 - REG:system.ini: UserInit=userinit,nddeagnt.exe
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file)
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [BrowserWebCheck] loadwc.exe
O4 - HKLM\..\Run: [Adaptec DirectCD] C:\PROGRA~1\HPCD-W~1\DirectCD\directcd.exe
O4 - HKLM\..\Run: [HP CD-Writer] C:\Program Files\HP CD-Writer\Mmenu\hpcdtray.exe
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [SchedulingAgent] mstinit.exe /logon
O4 - HKLM\..\Run: [Pop-Up Stopper] "G:\PROGRA~1\POPUPS~1\POP-UP~1\dpps2.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINNT\System32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinHelp] C:\WINNT\System32\WinHelp.exe
O4 - HKLM\..\Run: [WinGate initialize] C:\WINNT\System32\WinGate.exe -remoteshell
O4 - HKLM\..\Run: [Remote Procedure Call Locator] RUNDLL32.EXE reg678.dll ondll_reg
O4 - HKLM\..\Run: [Program In Windows] C:\WINNT\System32\IEXPLORE.EXE
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [Yahoo! Pager] G:\Program Files\Yahoo\Messenger\ypager.exe -quiet
O4 - Startup: America Online 5.0 Tray Icon.lnk = G:\Program Files\America Online 5.0\aoltray.exe
O4 - Global Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.EXE
O4 - Global Startup: EReg.lnk = EReg206\Reg32.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\QUICKENW\QWDLLS.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: @Home (HKCU)
O12 - Plugin for .mpeg: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin3.dll
O12 - Plugin for .mts: C:\Program Files\MetaCreations\MetaStream\npmetastream.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.cox.net
O16 - DPF: {02466323-75ED-11CF-A267-0020AF2546EA} (VivoActive Control) -

http://player.vivo.com/ie/vvweb.cab

O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) -

http://download.yahoo.com/dl/installs/yinst.cab

O16 - DPF: {3C648A72-C49A-48EF-9F90-68EF13293F97} (Cacher Class) -

http://xmlsweb2.socalmls.com/XMLSearch/XMLCache.CAB

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -

http://a1540.g.akamai.net/7/1540/52...pple.com/borris/us/win/QuickTimeInstaller.exe

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -

http://207.188.7.150/1991b21231cd55edfb00/netzip/RdxIE601.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

CaKiwi

 

[diogenes10]

I'd first do an online virus scan from pandasoft.
O4 - HKLM\..\Run: [Remote Procedure Call Locator] RUNDLL32.EXE reg678.dll ondll_reg

http://64.233.161.104/search?q=cach...us=39271+reg678.dll++ondll_reg&hl=en&ie=UTF-8

Would allow hijack this to fix these items:
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - (no file)
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
(the 06 line if you or your friend have not set the restrictions)
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -

http://207.188.7.150/1991b21231cd55edfb00/netzip/RdxIE601.cab

This one is a possible-I dont know if it's a substituted file:
F2 - REG:system.ini: UserInit=userinit,nddeagnt.exe

http://64.233.161.104/search?q=cach...1999-q3/0011.html+nddeagnt.exe&hl=en&ie=UTF-8

 

[diogenes10]

Also, dont know if nt4 supports current explorer, if it does, upgrade with critical updates applied would help security.

 

[jrbarnett]

NT 4 does support IE6, as I have put it on machines running the OS.

John

 

[CaKiwi]

Thanks for the assistance, I will try you suggestions tonight. The reason that windows and IE are not up to date is that I have had problems connecting it to my DSL service because windows is out of date (catch-22). I'm still working on that problem.

CaKiwi

 

[Xemus]

By the way, you can order a cd free from Microsoft with the latest updates (current to around November or so of last year) that they will send via postal mail.

http://www.microsoft.com/security/protect/cd/order.asp

If you can't download updates, this might be an option. Snail mail speeds tho.

http://www.closedsocket.com

 

[jrbarnett]

Xemus

Just had a look at that page, unfortunately it does not mention NT 4 as a supported operating system.
It's still worth knowing about the CD though.

John

 

[diogenes10]

thread748-789313 for comments.

My folder is dated February 2004, NT4 is not on the list of supported systems.

 

[CaKiwi]

Thanks for the assistance. The system seems to be in pretty good shape now.

CaKiwi

 

[Xemus]

Sorry, didn't look at the version of Windows. It's not really surprising that Microsoft isn't offering support for NT with this CD tho, as the official life cycle for NT 4 is over.

http://www.microsoft.com/windows/lifecycle/default.mspx

Good to hear you got it fixed tho, CaKiwi

http://www.closedsocket.com