What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Can u please have a look at this and telll me what u thi

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:02:24 AM, on 4/30/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~2\Avast4\ashDisp.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~2\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [WeatherEye] C:\Program Files\TheWeatherNetwork\WeatherEye\WeatherEye.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: CarbonPoker - {6FDD5236-C9F0-49ef-935D-385F5E21991A} - C:\Documents and Settings\Owner.Doodle\Start Menu\Programs\CarbonPoker\CarbonPoker.lnk (HKCU)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {48DF87EE-F2DE-11D8-BE7F-302050C10801} (FlyLoader Class) - http://www.flyword.com/loaderword_win.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1168806160611
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{02FBDB6D-780D-43E2-94D2-A61574E2B8FC}: NameServer = 64.59.184.13,64.59.184.15
O17 - HKLM\System\CS1\Services\Tcpip\..\{02FBDB6D-780D-43E2-94D2-A61574E2B8FC}: NameServer = 64.59.184.13,64.59.184.15
O17 - HKLM\System\CS2\Services\Tcpip\..\{02FBDB6D-780D-43E2-94D2-A61574E2B8FC}: NameServer = 64.59.184.13,64.59.184.15
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

–
End of file - 7505 bytes



and when i did scan with spybotS&D i noticed near the end it started scanning alot of files from "Zlob" and noticed alot of it is adult stuff not sure what or where it came from?
Post #2
— Report generated: 2009-04-30 09:58 — DoubleClick: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) AdRevolver: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) AdRevolver: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) AdRevolver: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) AdRevolver: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) AdRevolver: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) AdRevolver: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) AdRevolver: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) AdRevolver: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) AdRevolver: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) CasaleMedia: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) CasaleMedia: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) CasaleMedia: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) MediaPlex: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) MediaPlex: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) MediaPlex: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) MediaPlex: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) HitBox: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) HitBox: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) FastClick: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) FastClick: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) MediaPlex: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) Zedo: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) Zedo: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) Zedo: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) Statcounter: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) Zedo: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) Statcounter: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) HitsLink: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) MediaPlex: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) MediaPlex: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) MediaPlex: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) Clickbank: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) Statcounter: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) CasaleMedia: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) CasaleMedia: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) CasaleMedia: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) HitBox: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) CasaleMedia: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) CasaleMedia: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) FastClick: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) FastClick: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) Zedo: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) BurstMedia: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) Zedo: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) AdRevolver: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) CasaleMedia: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) Statcounter: Tracking cookie (Firefox: Owner (default)) (Cookie, nothing done) — Spybot - Search & Destroy version: 1.6.2 (build: 20090126) — 2009-01-26 blindman.exe (1.0.0.8) 2009-01-26 SDFiles.exe (1.6.1.7) 2009-01-26 SDMain.exe (1.0.0.6) 2009-01-26 SDShred.exe (1.0.2.5) 2009-01-26 SDUpdate.exe (1.6.0.12) 2009-01-26 SpybotSD.exe (1.6.2.46) 2009-03-05 TeaTimer.exe ([removed]) 2009-04-30 unins000.exe (51.49.0.0) 2009-01-26 Update.exe (1.6.0.7) 2009-01-26 advcheck.dll ([removed]) 2007-04-02 aports.dll (2.1.0.0) 2008-06-14 DelZip179.dll (1.79.11.1) 2009-01-26 SDHelper.dll (1.6.2.14) 2008-06-19 sqlite3.dll 2009-01-26 Tools.dll (2.1.6.10) 2009-01-16 UninsSrv.dll (1.0.0.0) 2009-03-25 Includes\Adware.sbi (*) 2009-04-28 Includes\AdwareC.sbi (*) 2009-01-22 Includes\Cookies.sbi (*) 2009-03-31 Includes\Dialer.sbi (*) 2009-04-21 Includes\DialerC.sbi (*) 2009-01-22 Includes\HeavyDuty.sbi (*) 2009-04-21 Includes\Hijackers.sbi (*) 2009-04-28 Includes\HijackersC.sbi (*) 2009-03-17 Includes\Keyloggers.sbi (*) 2009-04-28 Includes\KeyloggersC.sbi (*) 2004-11-29 Includes\LSP.sbi (*) 2009-04-07 Includes\Malware.sbi (*) 2009-04-28 Includes\MalwareC.sbi (*) 2009-03-25 Includes\PUPS.sbi (*) 2009-04-28 Includes\PUPSC.sbi (*) 2009-01-22 Includes\Revision.sbi (*) 2009-01-13 Includes\Security.sbi (*) 2009-04-21 Includes\SecurityC.sbi (*) 2008-06-03 Includes\Spybots.sbi (*) 2008-06-03 Includes\SpybotsC.sbi (*) 2009-04-07 Includes\Spyware.sbi (*) 2009-04-28 Includes\SpywareC.sbi (*) 2009-04-07 Includes\Tracks.uti 2009-04-29 Includes\Trojans.sbi (*) 2009-04-29 Includes\TrojansC.sbi (*) 2008-03-04 Plugins\Chai.dll 2008-03-05 Plugins\Fennel.dll 2008-02-26 Plugins\Mate.dll 2007-12-24 Plugins\TCPIPAddress.dll
Post #3
Hi SumDude,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Then

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).
Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI