|
hijakthis for popups that wont go away
|
|
|
ozzymary
Suspended permanently
|
2. January 2006 @ 05:34 |
Link to this message
|
|
no i just opened back up the program
|
|
Advertisement
|
|
|
|
|
-kemisti-
AfterDawn Addict
|
2. January 2006 @ 05:36 |
Link to this message
|
|
Ok, ewido just counts every infected object it has removed :) No worry needed. Send a fresh HjT-log, please.
|
|
ozzymary
Suspended permanently
|
2. January 2006 @ 05:52 |
Link to this message
|
Logfile of HijackThis v1.99.1
Scan saved at 10:51:47 AM, on 1/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\savedump.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Softex\OmniPass\OPXPApp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\msiexec.exe
C:\Documents and Settings\Owner\My Documents\my music\HijackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\companion\Installs\cpn\yt.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O4 - Global Startup: Desktop 16.lnk = C:\Program Files\Common Files\Desktop 16\TrueWeather.exe
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/...
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: OPXPGina - C:\Program Files\Softex\OmniPass\opxpgina.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
|
|
-kemisti-
AfterDawn Addict
|
2. January 2006 @ 05:55 |
Link to this message
|
|
Your log is clean :) Still having problems? I highly recommend to install another firewall.
|
|
ozzymary
Suspended permanently
|
2. January 2006 @ 05:56 |
Link to this message
|
|
which free firewall do you recomend .and do i have to delete windows firewall or just turn off tried sunbelt but it turned the screen blue and was doing this dump thing i deleted it
This message has been edited since posting. Last time this message was edited on 2. January 2006 @ 05:59
|
|
ozzymary
Suspended permanently
|
2. January 2006 @ 06:03 |
Link to this message
|
|
i do use frostwire alot and leave windows firewall leave it run ??????????????
|
|
-kemisti-
AfterDawn Addict
|
2. January 2006 @ 06:07 |
Link to this message
|
|
Try ZoneAlarm or Sygate then. You can't delete windows firewall, only turn it off :)
|
|
ozzymary
Suspended permanently
|
2. January 2006 @ 06:11 |
Link to this message
|
|
Sygate is it free ??????? and will it help i wonder why windows firewall is no good can you give me link for Sygate
|
|
ozzymary
Suspended permanently
|
2. January 2006 @ 06:14 |
Link to this message
|
i just ran Spybot search and destroy found 3 items iwonder why??????????
|
|
ozzymary
Suspended permanently
|
2. January 2006 @ 06:17 |
Link to this message
|
|
you there ??????????
|
|
-kemisti-
AfterDawn Addict
|
2. January 2006 @ 06:17 |
Link to this message
|
|
|
|
ozzymary
Suspended permanently
|
2. January 2006 @ 06:21 |
Link to this message
|
just did ewido and removed this
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 11:20:50 AM, 1/2/2006
+ Report-Checksum: 739E527F
+ Scan result:
C:\WINDOWS\ime\shared\ACDSee 9.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Adobe Photoshop 9 fuââ.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Ahead Nero 7.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Kaspersky Antivirus 5.0 -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\KAV 5.0 -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Matrix 3 Revolution English Subtitles.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Microsoft Office 2003 Crack, Working!.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Microsoft Office XP working Crack, Keygen.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Microsoft Windows XP, WinXP Crack, working Keygen.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Opera 8 New!.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Porno pics arhive, xxx.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Porno Screensaver.scr -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Porno, sex, oral, anal cool, awesome!!.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Serials.txt.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\WinAmp 5 Pro Keygen Crack Update.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\WinAmp 6 New!.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Windown Longhorn Beta Leak.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\Windows Sourcecode update.doc.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\ime\shared\XXX hardcore images.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\jdibyhtA.exe -> Hijacker.VB.ij : Cleaned with backup
C:\WINDOWS\offun.exe -> Downloader.VB.nw : Cleaned with backup
C:\WINDOWS\system32\1E262727232325.exe -> Trojan.VB.aft : Cleaned with backup
C:\WINDOWS\system32\399.exe -> Dropper.Agent.xw : Cleaned with backup
C:\WINDOWS\system32\aupdate.exe -> Downloader.Adload.k : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\ACDSee 9.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Adobe Photoshop 9 fuââ.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Ahead Nero 7.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Kaspersky Antivirus 5.0 -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\KAV 5.0 -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Matrix 3 Revolution English Subtitles.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Microsoft Office 2003 Crack, Working!.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Microsoft Office XP working Crack, Keygen.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Microsoft Windows XP, WinXP Crack, working Keygen.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Opera 8 New!.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Porno pics arhive, xxx.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Porno Screensaver.scr -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Porno, sex, oral, anal cool, awesome!!.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Serials.txt.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\WinAmp 5 Pro Keygen Crack Update.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\WinAmp 6 New!.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Windown Longhorn Beta Leak.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\Windows Sourcecode update.doc.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\config\systemprofile\Application Data\Symantec\Shared\XXX hardcore images.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\wingo.exe -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\wingo.exeopen -> Worm.Bagle.au : Cleaned with backup
C:\WINDOWS\system32\wingo.exeopenopen -> Worm.Bagle.au : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@ad.yieldmanager[1].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@adopt.specificclick[2].txt -> Spyware.Cookie.Specificclick : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@ads.pointroll[2].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@paypopup[1].txt -> Spyware.Cookie.Paypopup : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@trafficmp[2].txt -> Spyware.Cookie.Trafficmp : Cleaned with backup
::Report End
|
|
ozzymary
Suspended permanently
|
2. January 2006 @ 06:24 |
Link to this message
|
|
????????????
|
|
ozzymary
Suspended permanently
|
2. January 2006 @ 06:28 |
Link to this message
|
|
you there man
|
|
ozzymary
Suspended permanently
|
2. January 2006 @ 06:33 |
Link to this message
|
did it again and found this
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 11:32:03 AM, 1/2/2006
+ Report-Checksum: 5A299E0
+ Scan result:
C:\Documents and Settings\Owner\Cookies\owner@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
::Report End
this double click is what is coming up in Spybot seach and destroy
|
|
ozzymary
Suspended permanently
|
2. January 2006 @ 06:44 |
Link to this message
|
|
lunch break??????????
|
|
Advertisement
|
|
|
|
-kemisti-
AfterDawn Addict
|
2. January 2006 @ 07:19 |
Link to this message
|
|
|
