What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Log File

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Is this where I would send my log files?



Thanx
Logfile of HijackThis v1.98.2
Scan saved at 11:02:53 AM, on 11/6/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\CRWN32.EXE
C:\WINDOWS\SYSTEM\NTHS32.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\MFCNS.EXE
C:\WINDOWS\IPBA.EXE
C:\WINDOWS\SYSTEM\IEUI.EXE
C:\WINDOWS\JAVAFF.EXE
C:\WINDOWS\SYSAC32.EXE
C:\WINDOWS\SDKTZ.EXE
C:\WINDOWS\APPCB32.EXE
C:\WINDOWS\SYSTEM\IEEQ.EXE
C:\WINDOWS\SYSTEM\ADDHN32.EXE
C:\WINDOWS\SYSTEM\D3ZW32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\NETJT.EXE
C:\WINDOWS\SYSTEM\APIZM.EXE
C:\WINDOWS\SYSTEM\SDKZD.EXE
C:\WINDOWS\SYSTEM\CRKJ.EXE
C:\WINDOWS\SYSLY32.EXE
C:\WINDOWS\JAVACN32.EXE
C:\WINDOWS\SYSTEM\NTEQ.EXE
C:\WINDOWS\SYSTEM\APITF.EXE
C:\WINDOWS\SYSTEM\APPCR32.EXE
C:\WINDOWS\SYSTEM\APIXZ.EXE
C:\WINDOWS\SYSTEM\SYSES.EXE
C:\WINDOWS\SYSTEM\SDKAS32.EXE
C:\WINDOWS\MSYW32.EXE
C:\WINDOWS\SYSTEM\ATLIK32.EXE
C:\WINDOWS\CRWZ.EXE
C:\WINDOWS\APPIQ.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\BANETDSL\WINPOET\WINPPPOVERETHERNET.EXE
C:\WINDOWS\SYSTEM\HPZTSB05.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\WIN COMM\WINCOMM.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\PROGRAM FILES\WIN COMM\WINLOCK.EXE
C:\PROGRAM FILES\SONY CORPORATION\IMAGE TRANSFER\SONYTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\SYSES.EXE
C:\WINDOWS\SYSTEM\WINFQ.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\APPIQ.EXE
C:\WINDOWS\APIRA.EXE
C:\WINDOWS\SYSTEM\SDKAS32.EXE
C:\WINDOWS\IPPC.EXE
C:\WINDOWS\IPPC.EXE
C:\WINDOWS\SYSTEM\SYSES.EXE
C:\WINDOWS\SYSTEM\SYSES.EXE
C:\WINDOWS\SYSTEM\CRKJ.EXE
C:\WINDOWS\CRWZ.EXE
C:\WINDOWS\SYSTEM\WINFQ.EXE
C:\WINDOWS\MSYW32.EXE
C:\WINDOWS\IPPC.EXE
C:\WINDOWS\SYSTEM\SYSES.EXE
C:\WINDOWS\SYSTEM\SYSES.EXE
C:\WINDOWS\CRWZ.EXE
C:\WINDOWS\CRWZ.EXE
C:\WINDOWS\SYSTEM\WINFQ.EXE
C:\WINDOWS\SYSTEM\WINFQ.EXE
C:\WINDOWS\APPIQ.EXE
C:\WINDOWS\SYSTEM\CRKJ.EXE
C:\WINDOWS\SYSTEM\CRKJ.EXE
C:\WINDOWS\APPIQ.EXE
C:\WINDOWS\APPIQ.EXE
C:\WINDOWS\APPIQ.EXE
C:\WINDOWS\SYSTEM\SDKAS32.EXE
C:\WINDOWS\SYSAC32.EXE
C:\WINDOWS\SYSTEM\WINFQ.EXE
C:\WINDOWS\SYSTEM\WINFQ.EXE
C:\WINDOWS\SYSTEM\WINFQ.EXE
C:\WINDOWS\APPIQ.EXE
C:\WINDOWS\SYSTEM\SYSES.EXE
C:\WINDOWS\SYSTEM\SYSES.EXE
C:\WINDOWS\APPIQ.EXE
C:\WINDOWS\SYSTEM\WINFQ.EXE
C:\WINDOWS\SYSTEM\SYSES.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://213.159.117.134/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\temfg.dll/sp.html#29126
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\temfg.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\temfg.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\temfg.dll/sp.html#29126
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\temfg.dll/sp.html#29126
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\temfg.dll/sp.html#29126
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\temfg.dll/sp.html#29126
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.134/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://213.159.117.134/index.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Yahoo!
R3 - Default URLSearchHook is missing
N1 - Netscape 4: user_pref("browser.startup.homepage", "dslstart.verizon.net"); (C:\Program Files\Netscape\Users\User00\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: Class - {7F33EE95-71F6-CC46-9B9F-9B4D5BE2D80B} - C:\WINDOWS\D3DB32.DLL
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN0\YCOMP5_5_5_0.DLL (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [WinPoET] c:\BANetDSL\WinPoET\WinPPPoverEthernet.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb05.exe
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Win Comm] C:\PROGRAM FILES\WIN COMM\WINCOMM.EXE
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [CRWN32.EXE] C:\WINDOWS\CRWN32.EXE
O4 - HKLM\..\RunServices: [NTHS32.EXE] C:\WINDOWS\SYSTEM\NTHS32.EXE
O4 - HKLM\..\RunServices: [MFCNS.EXE] C:\WINDOWS\SYSTEM\MFCNS.EXE
O4 - HKLM\..\RunServices: [IPBA.EXE] C:\WINDOWS\IPBA.EXE
O4 - HKLM\..\RunServices: [IEUI.EXE] C:\WINDOWS\SYSTEM\IEUI.EXE
O4 - HKLM\..\RunServices: [JAVAFF.EXE] C:\WINDOWS\JAVAFF.EXE
O4 - HKLM\..\RunServices: [SYSAC32.EXE] C:\WINDOWS\SYSAC32.EXE
O4 - HKLM\..\RunServices: [SDKTZ.EXE] C:\WINDOWS\SDKTZ.EXE
O4 - HKLM\..\RunServices: [APPCB32.EXE] C:\WINDOWS\APPCB32.EXE
O4 - HKLM\..\RunServices: [IEEQ.EXE] C:\WINDOWS\SYSTEM\IEEQ.EXE
O4 - HKLM\..\RunServices: [ADDHN32.EXE] C:\WINDOWS\SYSTEM\ADDHN32.EXE
O4 - HKLM\..\RunServices: [D3ZW32.EXE] C:\WINDOWS\SYSTEM\D3ZW32.EXE
O4 - HKLM\..\RunServices: [NETJT.EXE] C:\WINDOWS\SYSTEM\NETJT.EXE
O4 - HKLM\..\RunServices: [APIZM.EXE] C:\WINDOWS\SYSTEM\APIZM.EXE
O4 - HKLM\..\RunServices: [SDKZD.EXE] C:\WINDOWS\SYSTEM\SDKZD.EXE
O4 - HKLM\..\RunServices: [SYSLY32.EXE] C:\WINDOWS\SYSLY32.EXE
O4 - HKLM\..\RunServices: [CRKJ.EXE] C:\WINDOWS\SYSTEM\CRKJ.EXE
O4 - HKLM\..\RunServices: [JAVACN32.EXE] C:\WINDOWS\JAVACN32.EXE
O4 - HKLM\..\RunServices: [APITF.EXE] C:\WINDOWS\SYSTEM\APITF.EXE
O4 - HKLM\..\RunServices: [NTEQ.EXE] C:\WINDOWS\SYSTEM\NTEQ.EXE
O4 - HKLM\..\RunServices: [APPCR32.EXE] C:\WINDOWS\SYSTEM\APPCR32.EXE
O4 - HKLM\..\RunServices: [APIXZ.EXE] C:\WINDOWS\SYSTEM\APIXZ.EXE
O4 - HKLM\..\RunServices: [SYSES.EXE] C:\WINDOWS\SYSTEM\SYSES.EXE
O4 - HKLM\..\RunServices: [SDKAS32.EXE] C:\WINDOWS\SYSTEM\SDKAS32.EXE
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Image Transfer.lnk = C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
O8 - Extra context menu item: Use webcow on this &Selection - C:\PROGRAM FILES\wcie.iemenu2.htm
O8 - Extra context menu item: &Use webcow on this Page - C:\PROGRAM FILES\wcie.iemenu.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\PROGRAM FILES\YAHOO!\COMMON\YLOGIN.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Login - {2499216C-4BA5-11D5-BD9C-000103C116D5} - C:\PROGRAM FILES\YAHOO!\COMMON\YLOGIN.DLL
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES.DLL
O9 - Extra button: SideFind - {10E42047-DEB9-4535-A118-B3F6EC39B807} - C:\PROGRAM FILES\SIDEFIND\SIDEFIND.DLL
O9 - Extra button: 50 FREE MP3s! - {686C970F-1D7D-4469-85D1-4B35763B56CC} - http://www.emusic.com/?fref=149024 (file missing)
O12 - Plugin for .ica: C:\BANETDSL\PROGRAM\PLUGINS\npican.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.yahoo.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.searchmiracle.com
O15 - Trusted Zone: *.searchbarcash.com
O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.my-internet.info
O15 - Trusted Zone: *.flingstone.com
O15 - Trusted Zone: *.mt-download.com
O15 - Trusted Zone: *.clickspring.net
O15 - Trusted Zone: *.05p.com
O15 - Trusted Zone: *.scoobidoo.com
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
Post #2
Are you still having problems with your computer? If so please Scan again with HijackTHis and POST a new log file here in this thread using Add Reply.
Post #3
This topic will be closed because it has been inactive for 21 days.

If you need it reopened, please send an email to the following (Click for address) with the Subject line of the email "Reopen".

To receive a response, please include in your email: your post user name, details of why you need it reopened, and a valid link to your post.

Emails with bad links to the post, emails that are not from the original poster, and emails that do not have "ReOpen" as the subject line, will be deleted without being opening.

Please start a New Topic if this is not your thread. Thank-you for your co-operation.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI