Please help me with this Hijack This! log

Discussion in 'Computer Support' started by wbabbit@gmail.com, Jun 12, 2007.

  1. Guest

    I had Vundomonde on my computer and successfully got rid of it, but I
    can't seem to keep popups from coming back fairly often. I have run
    spybot and ad-aware, spybot picks up the same tracking cookies every
    time, but no big ones (that I can tell).

    Logfile of HijackThis v1.99.1
    Scan saved at 9:37:06 AM, on 6/12/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16441)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\McAfee\Common Framework\FrameworkService.exe
    C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
    C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\sm56hlpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
    C:\Program Files\McAfee\Common Framework\UdaterUI.exe
    C:\Program Files\McAfee\Common Framework\McTray.exe
    C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    C:\Documents and Settings\Will\Desktop\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
    http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL
    = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
    http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
    http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-
    B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat
    \ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:
    \PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {5B1DE3C4-236C-44CF-81BB-2E0CE32E8DE6} - C:
    \WINDOWS\system32\jkhhg.dll (file missing)
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:
    \Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
    O2 - BHO: (no name) - {E12BFF69-38A7-406e-A8EF-2738107A7831} - C:
    \WINDOWS\system32\qutvuwjk.dll
    O2 - BHO: (no name) - {FFCC916A-50C1-452B-8FA0-B44F34AB8E9e} - C:
    \WINDOWS\system32\pdexjkci.dll
    O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut]
    HDAShCut.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS
    \system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP
    \SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP
    \SynTPEnh.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD
    \PDVDServ.exe"
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan
    Enterprise\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common
    Framework\UdaterUI.exe" /StartedFromRunKey
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google
    \Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime
    \qttask.exe" -atboottime
    O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin
    \ifrmewrk.exe /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools
    \daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk
    \googletalk.exe /autostart
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe
    \Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel -
    res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}
    - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-
    BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O14 - IERESET.INF: START_PAGE_URL=http://www.alienware.com
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine
    Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class)
    - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177128533250
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash
    Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:
    \Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:
    \PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945}
    - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
    O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
    O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless
    \Bin\LgNotify.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5}
    - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:
    \Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel
    \Wireless\Bin\EvtEng.exe
    O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google
    \Google Desktop Search\GoogleDesktop.exe
    O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown
    owner - C:\Program Files\McAfee\Common Framework
    \FrameworkService.exe" /ServiceStart (file missing)
    O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program
    Files\McAfee\VirusScan Enterprise\Mcshield.exe
    O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:
    \Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA
    Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel
    \Wireless\Bin\RegSrvc.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel
    Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
     
    , Jun 12, 2007
    #1
    1. Advertising

  2. Evan Platt Guest

    On Tue, 12 Jun 2007 08:42:11 -0700, wrote:

    >I had Vundomonde on my computer and successfully got rid of it, but I
    >can't seem to keep popups from coming back fairly often. I have run
    >spybot and ad-aware, spybot picks up the same tracking cookies every
    >time, but no big ones (that I can tell).


    Gosh, you think there'd be an automated tool or something to analyze a
    hijack this log huh?

    http://www.google.com/search?hl=en&q=analyze hijackthis log&btnG=Google Search&aq=t&oq=analyze hij
    --
    To reply via e-mail, remove The Obvious from my e-mail address.
     
    Evan Platt, Jun 12, 2007
    #2
    1. Advertising

  3. pcbutts1 Guest

    You are still infected. Use Remove-it version 11, it's fast and free. It now
    has over 2500 signatures to remove All variants of Virusburst, Spy Dawn,
    Spylock,and Antivermins. New Feature, Remove-it will now update your hosts
    file. This tool is designed to Specifically remove all variants. Scan time
    is about 2 minutes. Designed for Windows 2000/XP only. Password is still
    required.
    First read this page http://www.pcbutts1.com/downloads then use the email
    link on the bottom of the page to receive the software.


    Check my feedback and see what others have said about it
    http://pcbutts1-therealtruth.blogspot.com/


    Feedback is very important to the development of Remove-it.
    Let me know how it works. Send feedback here
    http://pcbutts1-therealtruth.blogspot.com/

    --

    Newsgroup Trolls. Read about mine here http://www.pcbutts1.com/downloads
    The list grows. Leythos the stalker http://www.leythosthestalker.com, David
    H. Lipman, Max M Wachtell III aka What's in a Name?, Fitz,
    Rhonda Lea Kirk, Meat Plow, F Kwatu F, George Orwell



    <> wrote in message
    news:...
    >I had Vundomonde on my computer and successfully got rid of it, but I
    > can't seem to keep popups from coming back fairly often. I have run
    > spybot and ad-aware, spybot picks up the same tracking cookies every
    > time, but no big ones (that I can tell).
    >
    > Logfile of HijackThis v1.99.1
    > Scan saved at 9:37:06 AM, on 6/12/2007
    > Platform: Windows XP SP2 (WinNT 5.01.2600)
    > MSIE: Internet Explorer v7.00 (7.00.6000.16441)
    >
     
    pcbutts1, Jun 12, 2007
    #3
  4. why? Guest

    On Tue, 12 Jun 2007 08:42:11 -0700, wrote:

    Silly person, see previous posts in 24HSHD
    http://groups.google.com/group/24hoursupport.helpdesk/topics
    for the other recent HJT log posts. You will find the URLs for the HTT
    sites where you can post the logs and get help.

    >I had Vundomonde on my computer and successfully got rid of it, but I
    >can't seem to keep popups from coming back fairly often. I have run
    >spybot and ad-aware, spybot picks up the same tracking cookies every
    >time, but no big ones (that I can tell).
    >
    >Logfile of HijackThis v1.99.1
    >Scan saved at 9:37:06 AM, on 6/12/2007
    >Platform: Windows XP SP2 (WinNT 5.01.2600)

    <snip>

    Me
     
    why?, Jun 12, 2007
    #4
  5. Aardvark Guest

    On Tue, 12 Jun 2007 09:04:03 -0700, Evan Platt wrote:

    > Gosh, you think there'd be an automated tool or something to analyze a
    > hijack this log huh?


    Well, that's a new one on me :)
    Automated HJT logs? What WILL they think of next?

    --
    Registered Linux User 413057.
    Both Mandriva 2007.1 and Ubuntu 7.04
    You can have it all. My empire of hurt.

    Liverpool F.C.-more European Cups than all
    the other English teams put together :)
     
    Aardvark, Jun 12, 2007
    #5
  6. Guest

    Doh! Thanks, don't know how I missed those...

    On Jun 12, 10:44 am, why? <fgrirp*sgc@VAINY!Qznq.fpvragvfg.pbz> wrote:
    > On Tue, 12 Jun 2007 08:42:11 -0700, wrote:
    >
    > Silly person, see previous posts in 24HSHDhttp://groups.google.com/group/24hoursupport.helpdesk/topics
    > for the other recent HJT log posts. You will find the URLs for the HTT
    > sites where you can post the logs and get help.
    >
    > >I had Vundomonde on my computer and successfully got rid of it, but I
    > >can't seem to keep popups from coming back fairly often. I have run
    > >spybot and ad-aware, spybot picks up the same tracking cookies every
    > >time, but no big ones (that I can tell).

    >
    > >Logfile of HijackThis v1.99.1
    > >Scan saved at 9:37:06 AM, on 6/12/2007
    > >Platform: Windows XP SP2 (WinNT 5.01.2600)

    >
    > <snip>
    >
    > Me
     
    , Jun 12, 2007
    #6
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Rich Gabriele

    Hijack This Log - Please Help

    Rich Gabriele, May 26, 2004, in forum: Computer Support
    Replies:
    1
    Views:
    445
    ┬░Mike┬░
    May 26, 2004
  2. Replies:
    8
    Views:
    568
  3. tek4u

    Hijack Log ~ Please Advise

    tek4u, Sep 15, 2005, in forum: Computer Support
    Replies:
    4
    Views:
    891
  4. Daryl

    Hijack This Log - Help Please!

    Daryl, Nov 12, 2005, in forum: Computer Support
    Replies:
    11
    Views:
    596
    Ron Martell
    Nov 14, 2005
  5. BIG DAVE

    HiJack-This log.... please help.

    BIG DAVE, Jan 17, 2008, in forum: Computer Support
    Replies:
    10
    Views:
    1,620
Loading...

Share This Page