What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijackthis Log

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Logfile of HijackThis v1.98.2
Scan saved at 2:48:21 PM, on 11/21/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\ATIKEY32.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\ATICWD32.EXE
C:\PROGRAM FILES\COMPAQ\SCROLL MOUSE\GNETMOUS.EXE
C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\WINPATROL.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\REMINDER.EXE
C:\PROGRAM FILES\NETSCAPE\NETSCAPE\NETSCP.EXE
C:\WINDOWS\TWAIN_32\1200UB\WATCH.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGMAIN.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGBHP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INCREDIBAR\BIN\IBMAIN.EXE
C:\HJT\HIJACKTHIS\HIJACKTHIS.EXE

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://google.com"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\f6long3s.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRAM%20FILES%5CMOZILLA.ORG%5CMOZILLA%5Csearchplugins%5CNetscapeSearch.src"); (C:\WINDOWS\Application Data\Mozilla\Profiles\default\f6long3s.slt\prefs.js)
O2 - BHO: IBBHO - {12BA043E-293E-4CE4-A8C7-8460934FE801} - C:\PROGRAM FILES\INCREDIBAR\BIN\IBBHO.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\PROGRAM FILES\SPYWAREGUARD\DLPROTECT.DLL
O3 - Toolbar: IncrediBar - {D8073790-84C7-4602-BF77-C6ACBF1612E4} - C:\PROGRAM FILES\INCREDIBAR\BIN\IBTBAR.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AtiKey] Atikey32.exe
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [QuickTime Task] C:\WINDOWS\SYSTEM\QTTASK.EXE
O4 - HKLM\..\Run: [LexStart] Lexstart.exe
O4 - HKLM\..\Run: [LexmarkPrinTray] PrinTray.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe
O4 - HKLM\..\Run: [Gnetmous] C:\Program Files\COMPAQ\Scroll Mouse\gnetmous.exe
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [WinPatrol] C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\winpatrol.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKCU\..\Run: [Reminder] C:\Program Files\Microsoft Money\SYSTEM\reminder.exe
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo
O4 - Startup: Watch.lnk = C:\WINDOWS\TWAIN_32\1200UB\WATCH.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - User Startup: Watch.lnk = C:\WINDOWS\TWAIN_32\1200UB\WATCH.exe
O4 - User Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YPAGER.EXE
O9 - Extra button: IncrediBar - {023FA804-DCE1-4817-94ED-6BA4200F9AF2} - C:\PROGRAM FILES\INCREDIBAR\BIN\IBTBAR.DLL
O12 - Plugin for .dcr: C:\Program Files\Netscape\Navigator\Program\PLUGINS\np32dsw.dll
O12 - Plugin for .aif: C:\Program Files\Netscape\Navigator\Program\PLUGINS\NPAUDIO.DLL
O12 - Plugin for .pd: C:\Program Files\Netscape\Navigator\Program\PLUGINS\NPSWF32.dll
O12 - Plugin for .mid: C:\Program Files\Netscape\Navigator\Program\PLUGINS\NPAUDIO.DLL
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup…er/imloader.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab

Here is the new log.
Post #32
Restart your computer in Safe Mode. Restart your computer. Press the F8 key until the startup menu appears. Choose the Safe Mode option then press Enter. See if you can run the anti-virus scan.
Post #34
StartDreck (build 2.1.7 public stable) - 2004-11-21 @ 16:45:17 (GMT -05:00) Platform: Windows 98 SE (Win 4.10.2222 A) Internet Explorer: 6.0.2800.1106 »Registry »Run Keys »Current User »Run *Reminder=C:\Program Files\Microsoft Money\SYSTEM\reminder.exe *Mozilla Quick Launch="C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo »RunOnce »Default User »Run *Reminder=C:\Program Files\Microsoft Money\SYSTEM\reminder.exe *Mozilla Quick Launch="C:\Program Files\Netscape\Netscape\Netscp.exe" -turbo »RunOnce »Local Machine »Run *SystemTray=SysTray.Exe *AtiKey=Atikey32.exe *ScanRegistry=c:\windows\scanregw.exe /autorun *LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme *QuickTime Task=C:\WINDOWS\SYSTEM\QTTASK.EXE *LexStart=Lexstart.exe *LexmarkPrinTray=PrinTray.exe *StillImageMonitor=C:\WINDOWS\SYSTEM\STIMON.EXE *TaskMonitor=c:\windows\taskmon.exe *AtiCwd32=Aticwd32.exe *PE2CKFNT SE=C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe *Gnetmous=C:\Program Files\COMPAQ\Scroll Mouse\gnetmous.exe *Tweak UI=RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp *WinPatrol=C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\winpatrol.exe *AVG7_CC=C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP *AVG7_EMC=C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE *AVG7_AMSVR=C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE »RunOnce »RunServices *LoadPowerProfile=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme »RunServicesOnce »RunOnceEx »RunServicesOnceEx »Browser Helper Objects (LM) *IBBHO.IBBHO.1/{12BA043E-293E-4CE4-A8C7-8460934FE801} `InprocServer32=C:\PROGRAM FILES\INCREDIBAR\BIN\IBBHO.DLL *{53707962-6F74-2D53-2644-206D7942484F} `InprocServer32=C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL *SpywareGuardDLBLOCK.CBrowserHelper/{4A368E80-174F-4872-96B5-0B27DDD11DB2} `InprocServer32=C:\PROGRAM FILES\SPYWAREGUARD\DLPROTECT.DLL »Files »System/Drivers »Running Processes +FFCFDB2D=C:\WINDOWS\SYSTEM\KERNEL32.DLL +FFFF8EDD=C:\WINDOWS\SYSTEM\MSGSRV32.EXE +FFFF9C4D=C:\WINDOWS\SYSTEM\MPREXE.EXE +FFFE0BD5=C:\WINDOWS\SYSTEM\mmtask.tsk +FFFE7529=C:\WINDOWS\EXPLORER.EXE +FFFD5901=C:\WINDOWS\SYSTEM\SYSTRAY.EXE +FFFEE29D=C:\WINDOWS\SYSTEM\ATIKEY32.EXE +FFFD246D=C:\WINDOWS\SYSTEM\QTTASK.EXE +FFFDC5FD=C:\WINDOWS\SYSTEM\WMIEXE.EXE +FFFD1871=C:\WINDOWS\SYSTEM\STIMON.EXE +FFFD29F9=C:\WINDOWS\TASKMON.EXE +FFFDE269=C:\WINDOWS\SYSTEM\ATICWD32.EXE +FFFD99B1=C:\WINDOWS\SYSTEM\SPOOL32.EXE +FFFDB9D5=C:\WINDOWS\SYSTEM\LEXBCES.EXE +FFFD8781=C:\PROGRAM FILES\COMPAQ\SCROLL MOUSE\GNETMOUS.EXE +FFFC561D=C:\WINDOWS\SYSTEM\RPCSS.EXE +FFFC64F9=C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\WINPATROL.EXE +FFFC1589=C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE +FFFC8289=C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE +FFFB4991=C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE +FFFB0F39=C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\REMINDER.EXE +FFFBCC29=C:\PROGRAM FILES\NETSCAPE\NETSCAPE\NETSCP.EXE +FFFBBFB5=C:\WINDOWS\TWAIN_32\1200UB\WATCH.EXE +FFFA5CED=C:\PROGRAM FILES\SPYWAREGUARD\SGMAIN.EXE +FFFC6AED=C:\PROGRAM FILES\SPYWAREGUARD\SGBHP.EXE +FFF8EE01=C:\UNZIPPED\STARTDRECK\STARTDRECK.EXE »Application specific Mr. Tate, I did the avg in safe mode and it said no viruses. At the bottom of the results it said D:\can not open, not checked, not scanned. Wasn't sure if you need to know this. Then I did StartDreck and this is what I got. At the bottom when you said (use save tab, to save, name and post the log) I did not know what you meant by name. If I did it wrong I will gladly redo it. Hope this helps. Corla
Post #35
Do you feel up to doing another virus scan?
Download a free trial version of Trojanhunter.
Click HERE and download the free trial version.

I've asked one of the Big Guns to take a look, so we'll see if they can come-up with something I might have missed.
Post #36
Is this what happens.
This is it, a tabbed browser with all the tabs closed.. a blank page with about:blank in the address bar. My home page is google by the way. This is quite normal if I close all the tabs.

[external image: Posted Image]
Post #39
:) Hello again, I put the trojan hunter on, but have no idea to what I am doing with it. I went to their site and tried reading about and I think it is running in the background, but not sure. When I double click the icon a box comes up and says ok and unload. I just push ok and it goes off. For now will leave it alone and maybe you can let me know how to use it correctly. Hopefully :( I am. I will wait for instructions for this tabbed browser. Not sure what you mean, but will figure it out with your help. I sure am learning alot trying to get to the problem of about:blank huh. Again :D thanks for all your help and if you need time for others I can hold on as long as you can. I will just keep checking back and seeing what you have for me next. Corla
Post #40
Ok, went looking to see just what you were talking about (tabbed browsers). It has to do with phishing attacks. Sneaky stuff huh. I do have netscape 7.2 and I have probably opened something in the mail that may not have been good. A few months ago (3-4) maybe more I opened a pay pal and an ebay message that were not correct. I am not really sure how long ago this was to be exact, but now that I think of it I had to redo my outlook express because I could not get in it. Maybe this helps maybe not. Just thought I would mention it. Good luck in finding a fix for this because I would never know where to begin. ;) Corla
Post #41
After you download trojan hunter, you should have a icon on the desktop that you double click and it will run the install. Once installed you should get a screen that ask to buy or continue trial version. Click trial version then at the top left of the page, click scan.
Post #42
Mr Tate, I did the trojan hunter and it said: Port scan port 5180/tcp is open (matches Peeper.120) file scan found trojan file: C:\ProgramFiles\CyberMediaOilChange\RegWizDr.exe it changed this to C:ProgramFiles\CyberMediaOilChange\RegWizDr.exe.tcf Said there was a trojan- cleaned- Cpuhog.100 After all of this I could not get back on internet today so I took of all my Netscape 7.2 stuff and the trojan hunter. I hope I didn't make this tougher for you. I still have the things to put them back on if you need them. I kept hanging and having to hard shut down. It was a mess and I would connect to the internet, but would get no pages. They wouldn't even come up. Sorry if I have made a mess of things. Will wait for yur reply. Corla
Post #43
I still have netscape 7.2 in my folders. The C: folders. I removed it from the startup menu only, but it is still on my menu bar next to the time. O.k. maybe this is better. My computer is running better, but still getting about:blank on all windows. I had no trouble getting back on the net and pages are coming up fine. Will wait for your reply. Corla

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI