The PC Guide Discussion Forums  
Google
Web The PC Guide
Studying for the A+, Network+ or Security+ exams? Get over 2,600 pages of FREE study guides at CertiGuide.com!
Join the PC homebuilding revolution! Read the all-new, FREE 200-page online guide: How to Build Your Own PC!
NOTE: Using robot software to mass-download the site degrades the server and is prohibited. See here for more.
Find The PC Guide helpful? Please consider a donation to The PC Guide Tip Jar. Visa/MC/Paypal accepted.

Go Back   The PC Guide Discussion Forums > Networking and Internet > Applications and Security
Reload this Page Need Urgent Help-Hijack Log
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Rate Thread
  #1  
Old 04-05-2005, 12:20 PM
gracious's Avatar
gracious gracious is offline
Master Geek
  
Join Date: Apr 2002
Location: latitude 30.3 N x longitude 87.8 W
Posts: 974
Need Urgent Help-Hijack Log
Hi oh magnificent ones!!
Ok, the puter I am working on is a work laptop used by one of my co-workers. This puter was loaded with 2 trojans which I was able to remove and 539 objects found by AdawareSE. I have done all of the win updates (os is Win98SE) and have run spybot and adaware and "2killme" and "CW Shredder" and I need someone to please read the log because I need to make sure it is clean before I give it back to be used...I appreciate it!!! Thank you
P.S He likes using the Google toolbar just so you know. I left it on.

************************************************** *******

Logfile of HijackThis v1.99.1
Scan saved at 11:01:48 AM, on 4/5/2005
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
c:\windows\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\SPYWAREKILLERS\HIJACK THIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.presario.net/scripts/...LC=0409&c=1c00
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gulftel.net/
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} - C:\WINDOWS\SYSTEM\NSM4276.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=1c00&lc=0409 (file missing)
O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=1c00&lc=0409 (file missing)
O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=1c00&lc=0409 (file missing)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=1c00&lc=0409 (file missing)
O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=1c00&lc=0409 (file missing)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/r...c=1c00&lc=0409 (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = gulftel.com
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 216.231.160.2,216.231.160.10
__________________
No Matter Where You Go......
There You Are!
Reply With Quote
  #2  
Old 04-05-2005, 02:07 PM
CuratoR's Avatar
CuratoR CuratoR is offline
Ascendant Master Geek
  
Join Date: Nov 2002
Location: anywhere I roam, where I lay my head is home, yeah!
Posts: 452
Send a message via ICQ to CuratoR
I don't see any fatal infections, but you can fix these.

R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - SOFTWARE - (no file)
O4 - HKLM\..\RunServices: [KB891711] c:\windows\SYSTEM\KB891711\KB891711.EXE
O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/...&c=1c00&lc=0409 (file missing)
O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/...&c=1c00&lc=0409 (file missing)
O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/...&c=1c00&lc=0409 (file missing)
O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - {06FE5D02-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/...&c=1c00&lc=0409 (file missing)
O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/...&c=1c00&lc=0409 (file missing)
O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - {06FE5D03-8F11-11d2-804F-00105A133818} - http://search.presario.net/scripts/...&c=1c00&lc=0409 (file missing)

About the KB891711.EXE, from what I know you don't have to keep tis ms-fix running every time.
__________________
In the land of Seatle, by the fires of Microsoft, the dark lord Bill Gates forged in, secret, a master OS, to controll all PCs.
And into this OS he put his greed, his malice and his will to dominate all computer media.
One OS to rule 'em all.
Reply With Quote
  #3  
Old 04-05-2005, 02:36 PM
gracious's Avatar
gracious gracious is offline
Master Geek
  
Join Date: Apr 2002
Location: latitude 30.3 N x longitude 87.8 W
Posts: 974
CuratoR~thank you for the quick response!! I have deleted those that you have recommended and I guess I did a pretty good job of cleaning all that junk out by everything I did.

Thank you for the reassurance!!
Sincerely,
Gracious
__________________
No Matter Where You Go......
There You Are!
Reply With Quote
  #4  
Old 04-05-2005, 08:00 PM
Budfred's Avatar
Budfred Budfred is offline
Amateur Master Geek
Moderator
  
Join Date: Jul 2002
Location: Minn
Posts: 17,851
CuratoR,

Those O9s do not need to be fixed... The (file missing) is due to a glitch in HJT that Merijn hasn't been able to fix... It will do the same thing in the O23s... Either way, don't fix them unless they are bad...

gracious,

This also needs to be fixed:

O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} - C:\WINDOWS\SYSTEM\NSM4276.DLL

It would be a good idea to post a fresh log after you run the fix...
__________________
Budfred ..... Caveat Emptor....

Helpful links SpywareBlaster... HijackThis... ATF Cleaner...

Post a complaint about malware here!!
So how did I get infected in the first place??

MS MVP 2006 and ASAP member since 2004...

If you PM me for help, expect an irritated response... Post in the forum...
Reply With Quote
  #5  
Old 04-05-2005, 11:23 PM
gracious's Avatar
gracious gracious is offline
Master Geek
  
Join Date: Apr 2002
Location: latitude 30.3 N x longitude 87.8 W
Posts: 974
Quote:
This also needs to be fixed:This also needs to be fixed:

O2 - BHO: ohb - {999A06FF-10EF-4A29-8640-69E99882C26B} - C:\WINDOWS\SYSTEM\NSM4276.DLL
Budfred, ty! I will remove that as soon as I can, I have already removed the O9's, do I need to put them back? Will it cause any problems if they are gone?
Thank you
__________________
No Matter Where You Go......
There You Are!
Reply With Quote
  #6  
Old 04-05-2005, 11:27 PM
Budfred's Avatar
Budfred Budfred is offline
Amateur Master Geek
Moderator
  
Join Date: Jul 2002
Location: Minn
Posts: 17,851
The O9s are just part of the Presario features that came with the computer and they are probably not used anyway, so you can probably just leave them fixed... If the user misses them, you can restore them from the HJT backup... I doubt the user will miss them though...
__________________
Budfred ..... Caveat Emptor....

Helpful links SpywareBlaster... HijackThis... ATF Cleaner...

Post a complaint about malware here!!
So how did I get infected in the first place??

MS MVP 2006 and ASAP member since 2004...

If you PM me for help, expect an irritated response... Post in the forum...
Reply With Quote
  #7  
Old 04-06-2005, 01:29 PM
CuratoR's Avatar
CuratoR CuratoR is offline
Ascendant Master Geek
  
Join Date: Nov 2002
Location: anywhere I roam, where I lay my head is home, yeah!
Posts: 452
Send a message via ICQ to CuratoR
Quote:
CuratoR, Those O9s do not need to be fixed... The (file missing) is due to a glitch in HJT that Merijn hasn't been able to fix... It will do the same thing in the O23s... Either way, don't fix them unless they are bad...
I suggested him to fix that becuz of the "file missing". They were useless.
__________________
In the land of Seatle, by the fires of Microsoft, the dark lord Bill Gates forged in, secret, a master OS, to controll all PCs.
And into this OS he put his greed, his malice and his will to dominate all computer media.
One OS to rule 'em all.
Reply With Quote
  #8  
Old 04-06-2005, 09:33 PM
Budfred's Avatar
Budfred Budfred is offline
Amateur Master Geek
Moderator
  
Join Date: Jul 2002
Location: Minn
Posts: 17,851
CuratoR,

I am sorry I wasn't clear... The point is that HJT misidentifies the O9s and O23s as (file missing) when the file is actually still there, so those items are not useless... That why it is a good idea to avoid fixing O9s or O23s unless you know they are bad....
__________________
Budfred ..... Caveat Emptor....

Helpful links SpywareBlaster... HijackThis... ATF Cleaner...

Post a complaint about malware here!!
So how did I get infected in the first place??

MS MVP 2006 and ASAP member since 2004...

If you PM me for help, expect an irritated response... Post in the forum...
Reply With Quote
  #9  
Old 04-07-2005, 09:39 AM
gracious's Avatar
gracious gracious is offline
Master Geek
  
Join Date: Apr 2002
Location: latitude 30.3 N x longitude 87.8 W
Posts: 974
Budfred~here is the latest log:



Logfile of HijackThis v1.99.1
Scan saved at 8:32:11 AM, on 4/7/2005
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\SPYWAREKILLERS\HIJACK THIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://desktop.presario.net/scripts/...LC=0409&c=1c00
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gulftel.net/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [mdac_runonce] C:\WINDOWS\SYSTEM\runonce.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsearch.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmsimilar.html
O8 - Extra context menu item: Backward Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate into English - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR2.DLL/cmtrans.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = gulftel.com
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 216.231.160.2,216.231.160.10


Thanks again guys HUGS HUGS
__________________
No Matter Where You Go......
There You Are!
Reply With Quote
  #10  
Old 04-07-2005, 09:55 AM
Budfred's Avatar
Budfred Budfred is offline
Amateur Master Geek
Moderator
  
Join Date: Jul 2002
Location: Minn
Posts: 17,851
Looks good!

Here is my prevention speech (although I think you have seen it before):

This is a good time to set up protection against further
attacks. Read the article linked below about "How did I
get infected". You need an antivirus that is updated, a
good firewall (a router firewall is not enough) and a
spyware blocker like SpywareBlaster and also IE-Spyads.
All of these have good free versions available... be very
cautious about any security software that advertises in
popups or other intrusive ways, they are not only usually
useless, but also often have malware in them....

http://www.computercops.biz/postlite7736-.html
__________________
Budfred ..... Caveat Emptor....

Helpful links SpywareBlaster... HijackThis... ATF Cleaner...

Post a complaint about malware here!!
So how did I get infected in the first place??

MS MVP 2006 and ASAP member since 2004...

If you PM me for help, expect an irritated response... Post in the forum...
Reply With Quote
  #11  
Old 04-07-2005, 08:44 PM
gracious's Avatar
gracious gracious is offline
Master Geek
  
Join Date: Apr 2002
Location: latitude 30.3 N x longitude 87.8 W
Posts: 974
Quote:
spyware blocker like SpywareBlaster and also IE-Spyads.
currently I am using AdAwareSE and Spybot, do I also need these two as well? And it is always nice to see the "Budfred" spyware spiel!! I gave the guy who's puter was infected similiar "Budfred" spiel lol....ty for all your help
__________________
No Matter Where You Go......
There You Are!
Reply With Quote
  #12  
Old 04-07-2005, 09:38 PM
Budfred's Avatar
Budfred Budfred is offline
Amateur Master Geek
Moderator
  
Join Date: Jul 2002
Location: Minn
Posts: 17,851
Ad-Aware SE and Spybot can clean up the mess... SpywareBlaster and IE-Spyads can prevent it... SpywareBlaster is run, sets a killbit for ActiveX infections and then is closed, so it doesn't even use resources... IE-Spyads isn't needed if you use FireFox or some other browser, but if you use IE, I would not go without it if at all possible....
__________________
Budfred ..... Caveat Emptor....

Helpful links SpywareBlaster... HijackThis... ATF Cleaner...

Post a complaint about malware here!!
So how did I get infected in the first place??

MS MVP 2006 and ASAP member since 2004...

If you PM me for help, expect an irritated response... Post in the forum...
Reply With Quote
  #13  
Old 04-09-2005, 04:13 PM
gracious's Avatar
gracious gracious is offline
Master Geek
  
Join Date: Apr 2002
Location: latitude 30.3 N x longitude 87.8 W
Posts: 974
Roger that!
__________________
No Matter Where You Go......
There You Are!
Reply With Quote
Reply

« Previous Thread | Next Thread »

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT -4. The time now is 04:41 AM.

Contact Us - The PC Guide - Archive - Top

Powered by vBulletin Version 3.6.1
Copyright ©2000 - 2010, Jelsoft Enterprises Ltd.
© Copyright 1997-2004 Charles M. Kozierok. All Rights Reserved.