What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijack This Log

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Damned… My firewall's going crazy blocking, and no matter how i seemed to scan witth Virus scans, spybot and ad-aware, there always seem to be something left behind… Pls help asap. thank You :)

Logfile of HijackThis v1.98.2
Scan saved at 9:19:23 AM, on 10/19/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\Apoint\Apoint.exe
C:\Madgix\MusicmatchJB\mmtask.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\winmgr.exe
C:\WINDOWS\System32\NotifyPhoneBook.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\System32\crsss32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Owner\Desktop\HijackThis.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\winssv.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.yahoo.com.sg/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Madgix\Spybot\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [mmtask] C:\Madgix\MusicmatchJB\mmtask.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [Microsoft Update Machine] winmgr.exe
O4 - HKLM\..\Run: [$WindowsRegKey%update] IEXPLORE.EXE
O4 - HKLM\..\Run: [Win32 NDIS Driver] xpndis.exe
O4 - HKLM\..\Run: [Microsoft Update] oovaqdt.exe
O4 - HKLM\..\Run: [USB Device] win32usb.exe
O4 - HKLM\..\Run: [blah service] internet.exe
O4 - HKLM\..\Run: [CRC Value Verifier] crsss32.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Madgix\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [Microsoft Update Machine] winmgr.exe
O4 - HKLM\..\RunServices: [$WindowsRegKey%update] IEXPLORE.EXE
O4 - HKLM\..\RunServices: [Win32 NDIS Driver] xpndis.exe
O4 - HKLM\..\RunServices: [Microsoft Update] oovaqdt.exe
O4 - HKLM\..\RunServices: [USB Device] win32usb.exe
O4 - HKLM\..\RunServices: [blah service] internet.exe
O4 - HKLM\..\RunServices: [CRC Value Verifier] crsss32.exe
O4 - HKLM\..\RunOnce: [Win32 NDIS Driver] xpndis.exe
O4 - HKLM\..\RunOnce: [USB Device] win32usb.exe
O4 - HKCU\..\Run: [Microsoft Update Machine] winmgr.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Win32 NDIS Driver] xpndis.exe
O4 - HKCU\..\Run: [USB Device] win32usb.exe
O4 - HKCU\..\Run: [Microsoft Update] oovaqdt.exe
O4 - HKCU\..\RunOnce: [USB Device] win32usb.exe
O4 - HKCU\..\RunOnce: [Win32 NDIS Driver] xpndis.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid;=0x409
O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} (PatchInstaller.Installer) - file://D:\content\include\XPPatchInstaller.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1098115953444
O16 - DPF: {8B1BC605-C593-4865-8F5B-05517F0CD0BB} (MSSecurityAdvisorCD Class) - file://D:\Content\include\msSecUcd.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{538BA388-9B11-4374-8B56-4A4D8C40ABF7}: NameServer = 165.21.83.88 165.21.100.88
O17 - HKLM\System\CS1\Services\Tcpip\..\{538BA388-9B11-4374-8B56-4A4D8C40ABF7}: NameServer = 165.21.83.88 165.21.100.88
Post #2
Greetings and welcome to TomCoyote.org!

Please go here:

System Restore

To learn how to turn system restore ON/OFF.

Then turn system restore OFF

Then try these free online virus scans of your system:

Trend-Micro Housecall

Panda Activescan

Etrust Security Advisor

Choose "fix" or "clean".

Let them remove any infections found. Reboot after each scan.

Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
MOVE HijackThis into this folder.

If required a tutorial is here = Hijackthis Folder Tutorial

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Scan".
Then "check" the box to the left of these item(s):

O4 - HKLM\..\Run: [Microsoft Update Machine] winmgr.exe

O4 - HKLM\..\Run: [$WindowsRegKey%update] IEXPLORE.EXE

O4 - HKLM\..\Run: [Win32 NDIS Driver] xpndis.exe

O4 - HKLM\..\Run: [Microsoft Update] oovaqdt.exe

O4 - HKLM\..\Run: [USB Device] win32usb.exe

O4 - HKLM\..\Run: [blah service] internet.exe

O4 - HKLM\..\Run: [CRC Value Verifier] crsss32.exe

O4 - HKLM\..\RunServices: [Microsoft Update Machine] winmgr.exe

O4 - HKLM\..\RunServices: [$WindowsRegKey%update] IEXPLORE.EXE

O4 - HKLM\..\RunServices: [Win32 NDIS Driver] xpndis.exe

O4 - HKLM\..\RunServices: [Microsoft Update] oovaqdt.exe

O4 - HKLM\..\RunServices: [USB Device] win32usb.exe

O4 - HKLM\..\RunServices: [blah service] internet.exe

O4 - HKLM\..\RunServices: [CRC Value Verifier] crsss32.exe

O4 - HKLM\..\RunOnce: [Win32 NDIS Driver] xpndis.exe

O4 - HKLM\..\RunOnce: [USB Device] win32usb.exe

O4 - HKCU\..\Run: [Microsoft Update Machine] winmgr.exe

O4 - HKCU\..\Run: [Win32 NDIS Driver] xpndis.exe

O4 - HKCU\..\Run: [USB Device] win32usb.exe

O4 - HKCU\..\Run: [Microsoft Update] oovaqdt.exe

O4 - HKCU\..\RunOnce: [USB Device] win32usb.exe

O4 - HKCU\..\RunOnce: [Win32 NDIS Driver] xpndis.exe

O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} (PatchInstaller.Installer) - file://D:\content\include\XPPatchInstaller.CAB

Then click "Fix checked".

Reboot in "safe" mode.

Find and delete:

c:\windows\system32\crsss32.exe <— file

c:\windows\system32\winmgr.exe <— file

c:\windows\system32\winssv.exe <— file

Use windows explorer to find and delete these:

internet.exe <— file

oovaqdt.exe <— file

win32usb.exe <— file

xpndis.exe <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode.

Then turn system restore ON

Reboot and "copy/paste" a new log file into this thread. :)
Post #3
Ok… Wow, thanks a lot! Here's the new log

Logfile of HijackThis v1.98.2
Scan saved at 10:52:02 AM, on 10/20/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Apoint\Apoint.exe
C:\Madgix\MusicmatchJB\mmtask.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\WINDOWS\System32\rundll32.exe
C:\Madgix\ZoneAlarm\zlclient.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\System32\NotifyPhoneBook.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Apoint\Apntex.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.yahoo.com.sg/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Madgix\Spybot\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [mmtask] C:\Madgix\MusicmatchJB\mmtask.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Madgix\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Digital Line Detect.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=34738&clcid=0x409
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1098115953444
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {8B1BC605-C593-4865-8F5B-05517F0CD0BB} (MSSecurityAdvisorCD Class) - file://D:\Content\include\msSecUcd.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab


Thanks a lot. Anything else I should take out??
Post #4
Good job!!! :thumbup:

I'd say you're "good to go"!!!

GOD bless!!!

M68 :)

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?" here:

http://boards.cexx.org/viewtopic.php?t=957

Download IE-Spyad here:

https://netfiles.uiuc.edu/ehowes/www/resource.htm

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings here:

http://browsercheck.qualys.com/index.php

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.
(Personally, I'm NOT recommending SP2 for XP at this time)

Post #5
This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI