What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Just a short check on my log.

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I would like to get my log checked by anyone here, because my pc has been acting weird, lately.

Thanks a lot in advance!


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:48:49, on 21-2-2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
c:\program files (x86)\windows live\messenger\msnmsgr.exe
c:\program files (x86)\java\jre6\bin\jusched.exe
c:\program files (x86)\mcafee.com\agent\mcagent.exe
c:\program files\logitech\setpoint\x86\setpoint32.exe
c:\program files (x86)\windows live\contacts\wlcomm.exe
c:\program files (x86)\trend micro\hijackthis\hijackthis.exe

r1 - hkcu\software\microsoft\internet explorer\main,search page = http://go.microsoft.com/fwlink/?linkid=54896
r0 - hkcu\software\microsoft\internet explorer\main,start page = http://www.google.nl/
r1 - hklm\software\microsoft\internet explorer\main,default_page_url = http://go.microsoft.com/fwlink/?linkid=69157
r1 - hklm\software\microsoft\internet explorer\main,default_search_url = http://go.microsoft.com/fwlink/?linkid=54896
r1 - hklm\software\microsoft\internet explorer\main,search page = http://go.microsoft.com/fwlink/?linkid=54896
r0 - hklm\software\microsoft\internet explorer\main,start page = http://go.microsoft.com/fwlink/?linkid=69157
r0 - hklm\software\microsoft\internet explorer\search,searchassistant =
r0 - hklm\software\microsoft\internet explorer\search,customizesearch =
r0 - hkcu\software\microsoft\internet explorer\toolbar,linksfoldername =
o1 - hosts: ::1 localhost
o2 - bho: acroiehelperstub - {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files (x86)\common files\adobe\acrobat\activex\acroiehelpershim.dll
o2 - bho: groove gfs browser helper - {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files (x86)\microsoft office\office12\grooveshellextensions.dll
o2 - bho: java™ plug-in ssv helper - {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files (x86)\java\jre6\bin\ssv.dll
o2 - bho: scriptproxy - {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files (x86)\mcafee\virusscan\scriptsn.dll
o2 - bho: windows live aanmelden - help - {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files (x86)\common files\microsoft shared\windows live\windowslivelogin.dll
o2 - bho: java™ plug-in 2 ssv helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files (x86)\java\jre6\bin\jp2ssv.dll
o4 - hklm\..\run: [sunjavaupdatesched] c:\program files (x86)\java\jre6\bin\jusched.exe
o4 - hklm\..\run: [startccc] c:\program files (x86)\ati technologies\ati.ace\core-static\clistart.exe msrun
o4 - hklm\..\run: [mcagent_exe] c:\program files (x86)\mcafee.com\agent\mcagent.exe /runkey
o4 - hkcu\..\run: [msnmsgr] c:\program files (x86)\windows live\messenger\msnmsgr.exe /background
o4 - hkus\s-1-5-19\..\run: [sidebar] %programfiles%\windows sidebar\sidebar.exe /detectmem (user 'local service')
o4 - hkus\s-1-5-19\..\run: [windowswelcomecenter] rundll32.exe oobefldr.dll,showwelcomecenter (user 'local service')
o4 - hkus\s-1-5-20\..\run: [sidebar] %programfiles%\windows sidebar\sidebar.exe /detectmem (user 'network service')
o4 - global startup: logitech setpoint.lnk = ?
o8 - extra context menu item: e&xporteren naar microsoft excel - res://c:\progra~2\micros~3\office12\excel.exe/3000
o9 - extra button: verzenden naar onenote - {2670000a-7350-4f3c-8081-5663ee0c6c49} - c:\progra~2\micros~3\office12\onbttnie.dll
o9 - extra 'tools' menuitem: verz&enden naar onenote - {2670000a-7350-4f3c-8081-5663ee0c6c49} - c:\progra~2\micros~3\office12\onbttnie.dll
o9 - extra button: research - {92780b25-18cc-41c8-b9be-3c9c571a8263} - c:\progra~2\micros~3\office12\refiebar.dll
o13 - gopher prefix:
o15 - trusted zone: http://*.mcafee.com
o16 - dpf: {d27cdb6e-ae6d-11cf-96b8-444553540000} (shockwave flash object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
o18 - protocol: groovelocalgws - {88fed34c-f0ca-4636-a375-3cb6248b04cd} - c:\program files (x86)\microsoft office\office12\groovesystemservices.dll
o23 - service: mcafee application installer cleanup (0207701235226123) (0207701235226123mcinstcleanup) - mcafee, inc. - c:\users\roel\appdata\local\temp\020770~1.exe
o23 - service: @%systemroot%\system32\alg.exe,-112 (alg) - unknown owner - c:\windows\system32\alg.exe (file missing)
o23 - service: mobiel apple apparaat (apple mobile device) - apple inc. - c:\program files (x86)\common files\apple\mobile device support\bin\applemobiledeviceservice.exe
o23 - service: ati external event utility - unknown owner - c:\windows\system32\ati2evxx.exe (file missing)
o23 - service: bonjour-service (bonjour service) - apple inc. - c:\program files (x86)\bonjour\mdnsresponder.exe
o23 - service: @dfsrres.dll,-101 (dfsr) - unknown owner - c:\windows\system32\dfsr.exe (file missing)
o23 - service: ipod-service (ipod service) - apple inc. - c:\program files (x86)\ipod\bin\ipodservice.exe
o23 - service: @keyiso.dll,-100 (keyiso) - unknown owner - c:\windows\system32\lsass.exe (file missing)
o23 - service: logitech bluetooth service (lbtserv) - logitech, inc. - c:\program files\common files\logishrd\bluetooth\lbtserv.exe
o23 - service: mcafee services (mcmscsvc) - mcafee, inc. - c:\progra~2\mcafee\msc\mcmscsvc.exe
o23 - service: mcafee network agent (mcnasvc) - mcafee, inc. - c:\progra~2\common~1\mcafee\mna\mcnasvc.exe
o23 - service: mcafee scanner (mcods) - mcafee, inc. - c:\progra~1\mcafee\viruss~1\mcods.exe
o23 - service: mcafee proxy service (mcproxy) - mcafee, inc. - c:\progra~2\common~1\mcafee\mcproxy\mcproxy.exe
o23 - service: mcafee real-time scanner (mcshield) - mcafee, inc. - c:\progra~1\mcafee\viruss~1\mcshield.exe
o23 - service: mcafee systemguards (mcsysmon) - mcafee, inc. - c:\progra~2\mcafee\viruss~1\mcsysmon.exe
o23 - service: mcafee personal firewall service (mpfservice) - mcafee, inc. - c:\program files (x86)\mcafee\mpf\mpfsrv.exe
o23 - service: @comres.dll,-2797 (msdtc) - unknown owner - c:\windows\system32\msdtc.exe (file missing)
o23 - service: @%systemroot%\system32\netlogon.dll,-102 (netlogon) - unknown owner - c:\windows\system32\lsass.exe (file missing)
o23 - service: @%systemroot%\system32\psbase.dll,-300 (protectedstorage) - unknown owner - c:\windows\system32\lsass.exe (file missing)
o23 - service: @%systemroot%\system32\locator.exe,-2 (rpclocator) - unknown owner - c:\windows\system32\locator.exe (file missing)
o23 - service: @%systemroot%\system32\samsrv.dll,-1 (samss) - unknown owner - c:\windows\system32\lsass.exe (file missing)
o23 - service: @%systemroot%\system32\slsvc.exe,-101 (slsvc) - unknown owner - c:\windows\system32\slsvc.exe (file missing)
o23 - service: @%systemroot%\system32\snmptrap.exe,-3 (snmptrap) - unknown owner - c:\windows\system32\snmptrap.exe (file missing)
o23 - service: @%systemroot%\system32\spoolsv.exe,-1 (spooler) - unknown owner - c:\windows\system32\spoolsv.exe (file missing)
o23 - service: steam client service - valve corporation - c:\program files (x86)\common files\steam\steamservice.exe
o23 - service: @%systemroot%\system32\ui0detect.exe,-101 (ui0detect) - unknown owner - c:\windows\system32\ui0detect.exe (file missing)
o23 - service: @%systemroot%\system32\vds.exe,-100 (vds) - unknown owner - c:\windows\system32\vds.exe (file missing)
o23 - service: @%systemroot%\system32\vssvc.exe,-102 (vss) - unknown owner - c:\windows\system32\vssvc.exe (file missing)
o23 - service: @%systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiapsrv) - unknown owner - c:\windows\system32\wbem\wmiapsrv.exe (file missing)
o23 - service: @%programfiles%\windows media player\wmpnetwk.exe,-101 (wmpnetworksvc) - unknown owner - c:\program files (x86)\windows media player\wmpnetwk.exe (file missing)
–
end of file - 7719 bytes


2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9 - Nederlands
AGEIA PhysX v7.11.13
Apple Software Update
Catalyst Control Center - Branding
CCleaner (remove only)
Choice Guard
dBpoweramp Music Converter
F.E.A.R. 2: Project Origin Single-player Demo
HD Tune 2.55
HijackThis 2.0.2
Java™ 6 Update 11
Last.fm 1.5.2.38918
LimeWire 5.0.11
Logitech SetPoint
Malwarebytes' Anti-Malware
McAfee SecurityCenter
Microsoft Office Access MUI (Dutch) 2007
Microsoft Office Enterprise 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (Dutch) 2007
Microsoft Office Groove MUI (Dutch) 2007
Microsoft Office InfoPath MUI (Dutch) 2007
Microsoft Office OneNote MUI (Dutch) 2007
Microsoft Office Outlook MUI (Dutch) 2007
Microsoft Office PowerPoint MUI (Dutch) 2007
Microsoft Office Proof (Dutch) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (German) 2007
Microsoft Office Proofing (Dutch) 2007
Microsoft Office Publisher MUI (Dutch) 2007
Microsoft Office Shared MUI (Dutch) 2007
Microsoft Office Word MUI (Dutch) 2007
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.0.6)
MSVCRT
MSXML 4.0 SP2 (KB954430)
OpenAL
QuickTime
Realtek 8169 8168 8101E 8102E Ethernet Driver
Security Update for 2007 Microsoft Office System (KB951550)
Security Update for 2007 Microsoft Office System (KB951550)
Security Update for 2007 Microsoft Office System (KB951944)
Security Update for 2007 Microsoft Office System (KB958439)
Security Update for Microsoft Office Excel 2007 (KB958437)
Security Update for Microsoft Office OneNote 2007 (KB950130)
Security Update for Microsoft Office PowerPoint 2007 (KB951338)
Security Update for Microsoft Office Publisher 2007 (KB950114)
Security Update for Microsoft Office system 2007 (KB954326)
Security Update for Microsoft Office system 2007 (KB956828)
Security Update for Microsoft Office Word 2007 (KB956358)
Steam
Team Fortress 2
Unreal Tournament 3
Update for Microsoft Office Outlook 2007 (KB952142)
Update for Office 2007 (KB946691)
Update for Outlook 2007 Junk Email Filter (kb959634)
Windows Live - Hulpprogramma voor uploaden
Windows Live aanmeldhulp
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Essentials
Windows Live Messenger
WinRAR
Post #2
Hi there,

Welcome to WhatTheTech.

As you are running 64 bit Windows, most of the tools we use will not work correctly. However, in most cases, malware will not work correctly either :)

I see you have LimeWire 5.0.11 installed. Malware writers love P2P programs as it gives them an easy method of transmitting their rubbish to unsuspecting users. I would highly recommend that you uninstall it.

Now the best method of ensuring that your computer is virus free, is to boot into safe mode and run a full scan with your AntiVirus. To do this, please follow these instructions.

Let me know if this stops your computer from "acting weird".

By the way, the log you posted has lots of colour. Did you add this yourself? It certainly makes reading through it easier. :thumbup:

Regards,
RatHat
Post #3 last edited
Hello there, Thank you for your reply. Well, I need LimeWire to download songs, everything that comes in is automatically being scanned by McAfee. I'll do the VirusScan today, and post the results here. The "acting weird" was about my pc not rebooting properly. When I made it reboot, it shut down and after that the screen went blank saying "No Signal". This doesn't happen every time I boot my pc. Also, when clicking on big files (such as game folders, or game patches +1GB), Windows Explorer sometimes stops responding and I have to relaunch it then. I don't know much about HJT logs, but the only thing that took my attention was all those "Missing File" lines. They are red here as I used a color converter.
Post #4

Well, I need LimeWire to download songs, everything that comes in is automatically being scanned by McAfee.
I'll do the VirusScan today, and post the results here.


That is no guarantee that you won't get infected. Some of the latest viruses even attach themselves to MP3 files and will infect a computer when played.

Let me know how it goes after you have run the scan in safe mode, and we will see if there is anything else that needs doing.

What is the colour converter you use, by the way? I like the way it works.
Post #5

Well, I need LimeWire to download songs, everything that comes in is automatically being scanned by McAfee.
I'll do the VirusScan today, and post the results here.


That is no guarantee that you won't get infected. Some of the latest viruses even attach themselves to MP3 files and will infect a computer when played.

Let me know how it goes after you have run the scan in safe mode, and we will see if there is anything else that needs doing.

What is the colour converter you use, by the way? I like the way it works.
Post #6
True, does a more secure program exist though?

I will let you know how it turns out.

The color converter is this one: http://ncf.ddrmmr.nl/hjt.html
The site is dutch, and you have to remove some tags as it's meant for a dutch forum I'm active on as well, this goes for the [Hjt] and [/hjt] tags + the and tags.
Post #7
Very neat converter! I wouldn't mind seeing something like that here!

The "acting weird" was about my pc not rebooting properly. When I made it reboot, it shut down and after that the screen went blank saying "No Signal".

This is very likely caused by the computer briefly shutting down the connection to the monitor during a reboot.
Post #8

Very neat converter! I wouldn't mind seeing something like that here!

The "acting weird" was about my pc not rebooting properly. When I made it reboot, it shut down and after that the screen went blank saying "No Signal".

This is very likely caused by the computer briefly shutting down the connection to the monitor during a reboot.

Yes, it's very useful.

As for the shutting down / rebooting problem: it has never done that before, that's why I thought it would be suspicious.

I'll do the virusscan as soon as possible.
Post #9
No results on the VirusScan. I couldn't find the file myagttry.exe and neither could I find the folder Managed Virus Scan, but McAfee booted itself and that's how I ran the full scan.
Post #10
How is the machine running now?

There is another check I can make.

Download OTScanIt2.exe to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt on your desktop.
  • Close ALL OTHER PROGRAMS.
  • Open the OTScanIt folder and double-click on OTScanIt2.exe to start the program.
  • Check the box that says Scan All Users
  • For File Age, choose 60 Days
  • Under Basic Scans leave all as default except:
    • Check the radio button under Rootkit Search for Yes
  • Now click the Run Scan button on the toolbar.
  • Let it run unhindered until it finishes.
  • When the scan is complete Notepad will open with the report file loaded in it.
  • Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Please zip the log and attach the zipped file in your next post.

To attach a file, do the following:
  • Click Add Reply
  • Under the reply panel is the Attachments Panel
  • Browse for the attachment file you want to upload, then click the green Upload button
  • Once it has uploaded, click the Manage Current Attachments drop down box
  • Click on [external image: Posted Image] to insert the attachment into your post
Post #11
It's still the same, I'm most worrying about those "missing files" though. It's not like my pc is running bad or something, but it just acts weird sometimes, a lot of WoW errors. Sometimes just freezes up when clicking 1GB+ files etc. I'll do that tonight.
Post #12
I don't really know what you meant with this:
Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Thus I haven't found the "Wordwrap" thing.


Anyways, the log is attached.

[attachment removed: OTScanIt.zip]
Post #13
Well the good news is that I am not seeing any malware in your system. The "missing files" is to HijackThis not being able to read a 64 bit system's file structure correctly. One comment on your system though is that as long as you continue to use Limewire, you are leaving yourself open to infection. What you think may be good can have had malicious code injected into it, and once you have it in your system, the AV will not be able to remove it. The only bonus is that by using a 64 bit system, malware is not targeting these systems much, yet. I will keep this log open for the next couple of days, so if you have any questions, please let me know. Regards, RatHat
Post #14
Alright, well thanks a lot for all the time you've put into this. I guess I'll have to find a replacement for LimeWire then. Thank you again.
Post #15

I guess I'll have to find a replacement for LimeWire then.


To be honest, there is no replacement. The three most dangerous uses of the web are:
  • Cracks and Keygens
  • P2P downloading
  • Porn site downloads
These are known by the malware writers to be the places where they have the best chance of successfully transmitting their carp**, so are the most common methods of infection that we deal with on the forums.

At the moment you have been lucky, but there is a virus that is becoming more prevalent named Virut. If you get this, it infects every executable file on your computer, and the only method of cleaning it is by reformatting and reinstalling the operating system. Virut is spread by the above three uses of the web.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI