Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations Mike Lewis on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

HijackThis log posted. Please advise! 2

Status
Not open for further replies.
GeekBros

GeekBros

Vendor
Jan 21, 2003
38
US
Thanks in Advance,
Steve



Logfile of HijackThis v1.97.7
Scan saved at 11:43:08 AM, on 12/21/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\EXPLORER.EXE
D:\HIJACK\HIJACKTHIS.EXE

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - _{8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
O1 - Hosts: 212.33.69.3 js1.hitbox.com
O1 - Hosts: 212.33.69.3 stats.hitbox.com
O1 - Hosts: 212.33.69.3 pagead2.googlesyndication.com
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {95E02C52-05FC-425D-8378-9DA70F9CD763} - C:\WINDOWS\SYSTEM\AADL.DLL
O2 - BHO: (no name) - {94927A13-4AAA-476A-989D-392456427688} - C:\WINDOWS\SYSTEM\MSECLK.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Hello from Picasa Capture (HKLM)
O9 - Extra 'Tools' menuitem: Share in &Hello from Picasa (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O10 - Unknown file in Winsock LSP: c:\windows\system\inetadpt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\inetadpt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\inetadpt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\inetadpt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\inetadpt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\inetadpt.dll
O10 - Unknown file in Winsock LSP: c:\windows\system\inetadpt.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - O16 - DPF: Yahoo! Spelldown - O16 - DPF: Yahoo! Spades - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - O16 - DPF: Yahoo! Word Racer - O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - O16 - DPF: Yahoo! Poker - O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - O16 - DPF: Yahoo! Tic-Tac-Toe - O16 - DPF: Yahoo! Chess - O16 - DPF: Yahoo! Literati - O16 - DPF: DigiChat Applet - O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - O16 - DPF: ChatSpace Full Java Client 3.1.0.235 - O16 - DPF: {645D793B-33E2-4175-A7E1-BA490839358A} (DNL Control) - O16 - DPF: Yahoo! Graffiti - O16 - DPF: Video Poker - O16 - DPF: {78960E0E-0B0C-11D4-8997-00104BD12D94} (AV Class) - O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - O16 - DPF: Yahoo! Hearts -


Steve McLean
Co-owner &
Director of Tech. Svcs.
Geek Bros. Computers
Chandler & Yuma, AZ USA
 
Sort by date Sort by votes
Let Hijack this! remove these entries:

R3 - URLSearchHook: (no name) - _{8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
O1 - Hosts: 212.33.69.3 js1.hitbox.com
O1 - Hosts: 212.33.69.3 stats.hitbox.com
O1 - Hosts: 212.33.69.3 pagead2.googlesyndication.com

You need to repair your LSP service:

Then download and run in this order:

cwshredder (Cool Web Shredder) *

SpyBot 1.2 *
AdAware *
* = First step is to update the program or defintion files within the programs.

Reboot.

You may need to repair your Winsock service:
 
Upvote 0 Downvote
There are a lot of entries which need removing from your log

After doing everything bcastner has told you....post a new log.

steam
 
Upvote 0 Downvote
Like this perhaps?

Process File: rundll or rundll.exe
Process Name: Rundll
Description: Added to the system as a result of the LOXOSCAM VIRUS! which is a backdoor Trojan that allows a hacker to gain access to the computer. It is written in the Delphi programming language.

I wanted to get the user to the point where some online antivirus scans by smah's faq was possible. faq760-3862
 
Upvote 0 Downvote
Log reposted as advised after following the steps posted by bcastner.

Thanks for the help folks!

Logfile of HijackThis v1.97.7
Scan saved at 3:25:41 PM, on 12/23/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\RunDLL.exe
D:\HIJACK\HIJACKTHIS.EXE

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {95E02C52-05FC-425D-8378-9DA70F9CD763} - C:\WINDOWS\SYSTEM\AADL.DLL
O2 - BHO: (no name) - {94927A13-4AAA-476A-989D-392456427688} - C:\WINDOWS\SYSTEM\MSECLK.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Hello from Picasa Capture (HKLM)
O9 - Extra 'Tools' menuitem: Share in &Hello from Picasa (HKLM)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - O16 - DPF: Yahoo! Spelldown - O16 - DPF: Yahoo! Spades - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - O16 - DPF: Yahoo! Word Racer - O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - O16 - DPF: Yahoo! Poker - O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - O16 - DPF: Yahoo! Tic-Tac-Toe - O16 - DPF: Yahoo! Chess - O16 - DPF: Yahoo! Literati - O16 - DPF: DigiChat Applet - O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - O16 - DPF: ChatSpace Full Java Client 3.1.0.235 - O16 - DPF: Yahoo! Graffiti - O16 - DPF: Video Poker - O16 - DPF: {78960E0E-0B0C-11D4-8997-00104BD12D94} (AV Class) - O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - O16 - DPF: Yahoo! Hearts - O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) -
Steve McLean
Co-owner &
Director of Tech. Svcs.
Geek Bros. Computers
Chandler & Yuma, AZ USA
 
Upvote 0 Downvote
Have hijack remove these two entries.

O2 - BHO: (no name) - {95E02C52-05FC-425D-8378-9DA70F9CD763} - C:\WINDOWS\SYSTEM\AADL.DLL
O2 - BHO: (no name) - {94927A13-4AAA-476A-989D-392456427688} - C:\WINDOWS\SYSTEM\MSECLK.DLL


What problems are you having now with IE?
 
Upvote 0 Downvote
Fix these as well

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

And I would fix all those 016 entries except Microsoft and macromedia ones.


 
Upvote 0 Downvote
Thanks to all! Everything is working perfectly now and best of all, NO MORE RE-DIRECTS AND POP-UPS!!!

Thanks again,

Steve McLean
Co-owner &
Director of Tech. Svcs.
Geek Bros. Computers
Chandler & Yuma, AZ USA
 
Upvote 0 Downvote
Status
Not open for further replies.

Similar threads

sthorne1271
  • Locked
  • Question
ActiveX Install Issue - Need help Please !!
Replies
2
Views
87
sthorne1271
sthorne1271
goombawaho
  • Locked
  • Question
Comcast login - auto filled account is not mine
Replies
9
Views
120
goombawaho
goombawaho
samurrai
  • Locked
  • Question
IE Auto Login Script for Password Protected Site
Replies
0
Views
55
samurrai
samurrai
goombawaho
  • Locked
  • Question
Microsoft badmouthing Firefox after logging out of Hotmail
Replies
3
Views
72
geeknerd
geeknerd
KellyK
  • Locked
  • Question
merlin log file?
Replies
1
Views
50
PCmad
PCmad

Part and Inventory Search

Sponsor

Back
Top