need Hijack This time running out

Discussion in 'adware, spyware & hijack cleaning' started by sweetguitargirl, Jul 14, 2004.

Thread Status:
Not open for further replies.
  1. sweetguitargirl

    sweetguitargirl Registered Member

    Joined:
    Jul 14, 2004
    Posts:
    5
    Location:
    in the midwest
    have trojans, pc getting more goofed up, need Hijack This, time running out, thanks
     
  2. sweetguitargirl

    sweetguitargirl Registered Member

    Joined:
    Jul 14, 2004
    Posts:
    5
    Location:
    in the midwest
    have Rat.cabronator, Keylog.God, and Trojan Dropper.yyyyyyyyy.
    pc keeps locking up req. reboot. getting more messed up.
    won't be much worth saving soon.
    TDS admin said go here.
    thank you.
     
  3. TonyKlein

    TonyKlein Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    4,350
    Location:
    The Netherlands
    Allrighty, go to https://www.wilderssecurity.com/showthread.php?t=12516, and download Hijack This.

    Unzip to a folder other than your Desktop or the Temp folder, doubleclick HijackThis.exe, and hit "Scan".

    When the scan is finished, the "Scan" button will change into a "Save Log" button.
    Press that, save the log somewhere, and please show us its contents.

    Most of what it lists will be harmless or even required, so do NOT fix anything yet.
    Someone here will be happy to help you analyze the results.
     
  4. sweetguitargirl

    sweetguitargirl Registered Member

    Joined:
    Jul 14, 2004
    Posts:
    5
    Location:
    in the midwest
    Here is the log:
    Logfile of HijackThis v1.97.7
    Scan saved at 9:19:34 PM, on 7/14/04
    Platform: Windows 98 Gold (Win9x 4.10.199:cool:
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NPROTECT.EXE
    C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
    C:\PROGRAM FILES\AVG\AVGSERV9.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\RNAAPP.EXE
    C:\WINDOWS\SYSTEM\TAPISRV.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\REGPROT\REGPROT.EXE
    C:\WINDOWS\SYSTEM\HOOKSYS.EXE
    C:\PROGRAM FILES\CREATIVE\LAUNCHER\CTLAUNCHER.EXE
    C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE
    C:\PROGRAM FILES\A4TECH\MOUSE\AMOUMAIN.EXE
    C:\PROGRAM FILES\CREATIVE\SHAREDLL\CTNOTIFY.EXE
    C:\PROGRAM FILES\COOKIEWALL\COOKIE.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\PROGRAM FILES\AVG\AVGCC32.EXE
    C:\PROGRAM FILES\CACHEMAN\CACHEMAN.EXE
    C:\PROGRAM FILES\RAMBOOSTER\RAMBOOSTER.EXE
    C:\PROGRAM FILES\CREATIVE\SHAREDLL\MEDIADET.EXE
    C:\PROGRAM FILES\FINJAN\SURFINGUARD PRO\BIN\WINSFCM.EXE
    C:\PROGRAM FILES\DIAMOND\INCONTROL TOOLS 98\DMHKEY.EXE
    C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\SYSDOC32.EXE
    C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON UTILITIES\NREGEDIT.EXE
    C:\PORT EXPLORER\PORTEXPLORER.EXE
    C:\PROGRAM FILES\NETSCAPE\NETSCAPE\NETSCP.EXE
    C:\PROGRAM FILES\JAP\JAP.EXE
    C:\PROGRAM FILES\JAVA\J2RE1.4.1_02\BIN\JAVAW.EXE
    C:\WINDOWS\SYSTEM\PSTORES.EXE
    C:\WATCHMAN'S STATION NO. 1\HIJACK THIS\HIJACKTHIS1977.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.buenavistaco.com/GOC/
    N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.buenavistaco.com/GOC/"); (C:\Program Files\Netscape\Users\cheney\prefs.js)
    O2 - BHO: (no name) - {F8A53FBE-5846-11D2-A022-006097D2400E} - C:\PROGRAM FILES\MINDMAKER\COMMON FILES\WINDOWS\IELINK.DLL
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
    O2 - BHO: (no name) - {2843DAC1-05EF-11D2-95BA-0060083493D6} - D:\Program Files\Dragon Systems\NaturallySpeaking\Program\web_ie.dll
    O2 - BHO: (no name) - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS\SYSTEM\IETie.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [Voodoo2] rundll32.exe 3dfxv2ps.dll,UpdateRegSettings
    O4 - HKLM\..\Run: [RegProt] c:\regprot\regprot.exe /start
    O4 - HKLM\..\Run: [HookSys] HookSys.exe
    O4 - HKLM\..\Run: [Creative Launcher] C:\Program Files\Creative\Launcher\CTLauncher.exe
    O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
    O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4TECH\MOUSE\AMOUMAIN.EXE
    O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
    O4 - HKLM\..\Run: [CookieWall] C:\PROGRAM FILES\COOKIEWALL\COOKIE.EXE
    O4 - HKLM\..\Run: [NPROTECT] C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    O4 - HKLM\..\Run: [AVG_CC] c:\PROGRA~1\AVG\avgcc32.exe /STARTUP
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [NPROTECT] C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
    O4 - HKLM\..\RunServices: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
    O4 - HKLM\..\RunServices: [Avgserv9.exe] c:\PROGRA~1\AVG\Avgserv9.exe
    O4 - HKCU\..\Run: [Cacheman] C:\PROGRAM FILES\CACHEMAN\Cacheman.exe
    O4 - HKCU\..\Run: [RamBooster] C:\PROGRAM FILES\RAMBOOSTER\RAMBOOSTER.EXE
    O4 - Startup: PowerReg Scheduler.exe
    O4 - Startup: SurfinGuard Pro.lnk = C:\Program Files\Finjan\SurfinGuard Pro\bin\winsfcm.exe
    O4 - Startup: InControl Desktop Manager.lnk = C:\Program Files\Diamond\InControl Tools 98\DMHKEY.EXE
    O4 - Startup: Norton System Doctor.lnk = C:\Program Files\Norton SystemWorks\Norton Utilities\SYSDOC32.EXE
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O16 - DPF: {EE8B6D5F-FEF2-11D0-B13F-00A024798EF3} (Microsoft Search Settings Control) - http://lg.home.microsoft.com/search/lobby/searchsettings.cab
    O16 - DPF: Win32 Classes - file://C:\WINDOWS\Java\classes\win32ie4.cab
    O16 - DPF: {1552B1CD-8CB7-4776-B6CB-16EA461928E5} (Cpuid Control) - http://powe45.vwh.net/downloads/upgradefinder.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = ruraltel.net
    O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = ruraltel.net
    O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 24.225.0.1,24.225.0.253
     
  5. sweetguitargirl

    sweetguitargirl Registered Member

    Joined:
    Jul 14, 2004
    Posts:
    5
    Location:
    in the midwest
    If I type more than 5 or 6 lines here, pc locks requiring reboot.
    Cannot web surf in Netscape direct cnnctn anymore as should, only with JAP.
     
  6. sweetguitargirl

    sweetguitargirl Registered Member

    Joined:
    Jul 14, 2004
    Posts:
    5
    Location:
    in the midwest
    TDS-3 updater freezes at 600K to 900K.
    Got manual update downloaded and all trojan warnings vanished.
    But something is wrong. If type more here, pc will freeze. Well, U hve log. help!
     
  7. TonyKlein

    TonyKlein Security Expert

    Joined:
    Feb 9, 2002
    Posts:
    4,350
    Location:
    The Netherlands
    Your log seems absolutely clean to me; no obvious rogue startups nor suspicious processes.

    Amazingly, your machine would probably run better WITHOUT Cacheman and Rambooster; they probably consume more system resources than that they help save them....

    And could you tell us more about this running process, please?

    C:\PROGRAM FILES\JAP\JAP.EXE

    What exactly is that JAP Program?

    And I take it that HookSys.exe is SurfinGuard Pro?

    You should try disabling unneccesary startups, and do some housecleaning: emptying the contents of your Windows\Temp folder, defragmenting your drive, and so on.
     
Thread Status:
Not open for further replies.