What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Find The Bad Guys

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello. I've been having a variety suspicious symptoms on my machine. I've scanned with McAfee VS and found and cleaned a few trojans and viruses on the first pass. All was clean after a reboot and an additional scan (done in Safe Mode). Spybot S&D found a couple of things (while in Safe Mode) that I didn't want running, and I fixed those.

Can you take a look at my Hijack This log (done in Safe Mode) and advise on what else has to be fixed? Thanks.

I've got to leave a couple of questionable items on my computer that you might normally warn me about. Though aspects of these items are sometimes a bother, to my knowledge they haven't tried to take over my machine. I'm looking for the real culprits.

Here are the things I want to keep, unless you feel strongly that I'm naive about the evil that some of these do.

Dogpile toolbar
Viewpoint toolbar, Viewpoint manager
WhenU related items (toolbar, clocksync)
RoboForm
Amplify
eFax
FirstPlace Toolbar


Logfile of HijackThis v1.97.7
Scan saved at 2:54:06 PM, on 10/13/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\Explorer.EXE
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dogpile.com/info.dogpl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dogpile.com/info.dogpl/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.dogpile.com/info.dogpl.toolbar/
O2 - BHO: (no name) - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINNT\EliteToolBar\EliteToolBar version 53.dll (file missing)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\System32\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Nnmgr] C:\WINNT\nnmgr.exe
O4 - HKLM\..\Run: [Microsoft DNS Query] msdns.exe
O4 - HKLM\..\Run: [WhenUSearchWHSE] C:\Program Files\WhenUSearch\whse.exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ClockSync] "C:\Program Files\ClockSync\Sync.exe" /q
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - Startup: Internet Explorer.lnk = C:\Program Files\Internet Explorer\IEXPLORE.EXE
O4 - Global Startup: Amplify.lnk = C:\Program Files\Amplify\Amplify.exe
O4 - Global Startup: eFax.com Tray Menu.lnk = C:\Program Files\Common Files\efax\HotTray.exe
O4 - Global Startup: Live Menu.lnk = C:\Program Files\Common Files\efax\Dllcmd32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O8 - Extra context menu item: A&dd To Amp - res://C:\Program Files\Amplify\resources.dll/contextmenuaddto.html
O8 - Extra context menu item: Customize Menu &4 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Dogpile Cursor Search - C:\Documents and Settings\All Users\Application Data\Infospace\DogpileToolbar\contextsearch.htm
O8 - Extra context menu item: First Place Cursor Search - C:\Documents and Settings\All Users\Application Data\Infospace\FirstplaceToolbar\contextsearch.htm
O8 - Extra context menu item: RoboForm &2 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: RoboForm (HKLM)
O9 - Extra 'Tools' menuitem: RoboForm &2 (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {127698E4-E730-4E5C-A2B1-21490A70C8A1} (CEnroll Class) - http://digitalid.verisign.com/xenroll.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_file.php…a0ff52018b5612d
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200112…meInstaller.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = inspinc.ad
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = inspinc.ad
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = inspinc.ad

Thanks for you advice!

A few related questions:

1. Does it matter if I run McAfee, Spybot, and Hijack This in Safe Mode instead of regular mode?
2. Do you have a resource you recommend where I can educate myself about which processes and actions to allow or prevent via my firewall. I have no idea which communications are necessary for my machine to run correctly and which are actions that enable the hijackers to operate on my machine. For example, I can enable or prevent "lsass.exe" from accessing the Internet. Where can I learn what to permit and what to prevent? McAfee, make of my firewall, seems a little lite on educating about these things.

- Kevin
Post #2
If you still require help and have not post at another forum listed here ASAP members forums
As some of us work here and in the other forums. Posting two forums slows the help needed for others.
Now please make sure that you have the followed instructions on how to :

Set up a HijackThis folder properly to post a log click here.
And you have the newer of HijackThis1.98.2 Download it here

Make sure that you have Scan with Spybot S&D and Ad-Aware correctly click here

Have run at least one online scan, allowed them to delete whatever they find:
TrendMicro HouseCall eTrust AntiVirus Web Scanner Panda ActiveScan
And Note any thing that can't be fixed in your next post

Also Make sure you have the latest critical updates from windows update.

And finely run System Security Suite click here to download
Extract it from the zip file into a folder. Under "items to clear" click all. Then click "clear selected items"

Rescan with HJT and post a new log here using add reply.

If you would like for us to help and have posted at another forum please have them close your thread.
If you no longer need your assistance please post a reply here.
Post #3
Due to inactivity this topic will be closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.

To help keep you clean follow the recommendations in Tony's article here:
So how did I get infected in the first place?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI