Hijack This log

Discussion in 'adware, spyware & hijack cleaning' started by ericb504, Jun 8, 2004.

Thread Status:
Not open for further replies.
  1. ericb504

    ericb504 Registered Member

    Joined:
    Jun 8, 2004
    Posts:
    1
    Location:
    New Orleans area, Louisiana, USA
    My friend has something which resembles searchweb on his computer. The log doesn't appear to me to have the normal entries for searchweb, but there are several temp internet files which have searchweb in them and ads popup all the time. The thing has a gif which sits on the desktop, plays music or something and cannot be deleted since it is replaced everytime the computer is started.

    Here is the HijackThis log file:

    Logfile of HijackThis v1.97.7
    Scan saved at 3:46:00 PM, on 6/8/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Citrix\ICA Client\ssonsvr.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\AdSubtract\adsub.exe
    C:\WINDOWS\System32\zstatus.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\stuff\xq-xfind\XFind.exe
    C:\stuff\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=AdSubtract:4444
    O4 - HKLM\..\Run: [hp 1000 firmware] C:\Program Files\hp LaserJet 1000\fwdl.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
    O4 - HKCU\..\Run: [SPYKILLER] C:\Program Files\Anonymizer\sk\SpyWareKiller.exe /BOOT
    O4 - Global Startup: AdSubtract.LNK = C:\Program Files\AdSubtract\adsub.exe
    O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab
    O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?1086206367553
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = office.rocknrollautosales.com
    O17 - HKLM\Software\..\Telephony: DomainName = office.rocknrollautosales.com
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = office.rocknrollautosales.com
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = office.rocknrollautosales.com
     
  2. Gavin - DiamondCS

    Gavin - DiamondCS Former DCS Moderator

    Joined:
    Feb 10, 2002
    Posts:
    2,080
    Location:
    Perth, Western Australia
Thread Status:
Not open for further replies.