What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijack This Log

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I would appreciate any help with eliminating the problems that seem
to constantly hijack my browser. I can't decipher the good from the
bad files, so any advice is appreciated.

Logfile of HijackThis v1.97.7
Scan saved at 8:02:54 PM, on 11/19/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\NETWOR~1\VIRUSS~1\AMGRSRVC.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\Network Associates\VirusScan NT\MCSHIELD.EXE
C:\PROGRA~1\NETWOR~1\VIRUSS~1\VSTSKMGR.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Network Associates\VirusScan NT\SHSTAT.EXE
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
C:\Program Files\USB Card Reader Driver v2.1g\Disk_Monitor.exe
C:\Program Files\QuickTime\qttask.exe
C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\llv4ut.exe
C:\WINNT\sy64or.exe
C:\WINNT\SPnt64ntSP.exe
C:\WINNT\64PEsyPEms.exe
C:\Program Files\OLYMPUS\CAMEDIA Master 4.2\CM_camera.exe
C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\hpodev07.exe
C:\picture package\Picture Package Menu\SonyTray.exe
C:\picture package\Picture Package Applications\Residence.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\MHPRMIND.EXE
C:\PROGRA~1\HEWLET~1\HPPSC7~1\bin\hpoevm07.exe
C:\WINNT\system32\hpoipm07.exe
C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\HPOSTS07.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Jason Oncay\Desktop\HijackThis.exe
C:\Program Files\Common Files\Real\Update_OB\rndal.exe
C:\Program Files\Common Files\Real\Update_OB\rndal.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?p…B_PVER}&ar=home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?p…er=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r2.attbi.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = sas.r2.attbi.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = C:\WINNT\system32\searchbar.html
R3 - URLSearchHook: (no name) - {3E7FF0CC-708E-FD10-2E7F-22574FBB06A8} - C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\llv4ut.exe
F2 - REG:system.ini: UserInit=C:\WINNT\System32\userinit.exe,C:\WINNT\System32\svcinit.exe
N3 - Netscape 7: user_pref("browser.startup.homepage","www.yahoo.com"); (C:\Documents and Settings\Jason Oncay\Application Data\Mozilla\Profiles\default\fsfqmu9l.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_02.src"); (C:\Documents and Settings\Jason Oncay\Application Data\Mozilla\Profiles\default\fsfqmu9l.slt\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan NT\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINNT\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [Disk Monitor] C:\Program Files\USB Card Reader Driver v2.1g\Disk_Monitor.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ACCF94FE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\yisg8.exe
O4 - HKLM\..\Run: [9F5A5A6B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\j3k.exe
O4 - HKLM\..\Run: [982D4856] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\llv4ut.exe
O4 - HKLM\..\Run: [FE6DB06B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\jv4.exe
O4 - HKLM\..\Run: [8BADCDD3] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ja75ecdpi.exe
O4 - HKLM\..\Run: [A8FA82CB] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\1nsof0jnq8.exe
O4 - HKLM\..\Run: [0BAF9EFE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\0suj4ckzdik.exe
O4 - HKLM\..\Run: [E48B5B76] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\m97zo8xan11.exe
O4 - HKLM\..\Run: [41AF1666] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\67lwcicu7.exe
O4 - HKLM\..\Run: [DE59726B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\3pr.exe
O4 - HKLM\..\Run: [DA0DF086] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\2jyd51.exe
O4 - HKLM\..\Run: [003F4D56] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\2usb.exe
O4 - HKLM\..\Run: [E183CC43] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\xdlw.exe
O4 - HKLM\..\Run: [C119BCF6] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ko24e4z5y.exe
O4 - HKLM\..\Run: [8993D0DB] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\7zeo8q93.exe
O4 - HKLM\..\Run: [D0A44763] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\xsn4f3tryrmn.exe
O4 - HKLM\..\Run: [F4C79B5E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\g50u0sk4.exe
O4 - HKLM\..\Run: [DBB93E5E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\rcp6sku.exe
O4 - HKLM\..\Run: [AB7A7FDE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\sjr2i2uwcd.exe
O4 - HKLM\..\Run: [AF195B6B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\2xe.exe
O4 - HKLM\..\Run: [FF810953] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ikxryh0f3.exe
O4 - HKLM\..\RunServices: [SpoolService] spolsv.exe
O4 - HKCU\..\Run: [Explorer] C:\WINNT\System32\shellexp.exe en
O4 - HKCU\..\Run: [SpywareGuardPlus] C:\WINNT\system32\winmm64.exe
O4 - HKCU\..\Run: [sy64or] C:\WINNT\sy64or.exe
O4 - HKCU\..\Run: [SPnt64ntSP] C:\WINNT\SPnt64ntSP.exe
O4 - HKCU\..\Run: [ACCF94FE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\yisg8.exe
O4 - HKCU\..\Run: [64PEsyPEms] C:\WINNT\64PEsyPEms.exe
O4 - HKCU\..\Run: [9F5A5A6B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\j3k.exe
O4 - HKCU\..\Run: [982D4856] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\llv4ut.exe
O4 - HKCU\..\Run: [FE6DB06B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\jv4.exe
O4 - HKCU\..\Run: [8BADCDD3] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ja75ecdpi.exe
O4 - HKCU\..\Run: [A8FA82CB] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\1nsof0jnq8.exe
O4 - HKCU\..\Run: [0BAF9EFE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\0suj4ckzdik.exe
O4 - HKCU\..\Run: [E48B5B76] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\m97zo8xan11.exe
O4 - HKCU\..\Run: [41AF1666] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\67lwcicu7.exe
O4 - HKCU\..\Run: [DE59726B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\3pr.exe
O4 - HKCU\..\Run: [DA0DF086] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\2jyd51.exe
O4 - HKCU\..\Run: [003F4D56] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\2usb.exe
O4 - HKCU\..\Run: [E183CC43] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\xdlw.exe
O4 - HKCU\..\Run: [C119BCF6] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ko24e4z5y.exe
O4 - HKCU\..\Run: [8993D0DB] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\7zeo8q93.exe
O4 - HKCU\..\Run: [D0A44763] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\xsn4f3tryrmn.exe
O4 - HKCU\..\Run: [F4C79B5E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\g50u0sk4.exe
O4 - HKCU\..\Run: [DBB93E5E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\rcp6sku.exe
O4 - HKCU\..\Run: [AB7A7FDE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\sjr2i2uwcd.exe
O4 - HKCU\..\Run: [AF195B6B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\2xe.exe
O4 - HKCU\..\Run: [FF810953] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ikxryh0f3.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Startup: Microsoft Greetings Reminders.lnk = C:\Program Files\MHPRMIND.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: CAMEDIA Master.lnk = C:\Program Files\OLYMPUS\CAMEDIA Master 4.2\CM_camera.exe
O4 - Global Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\hpodev07.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Picture Package Menu.lnk = C:\picture package\Picture Package Menu\SonyTray.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = C:\picture package\Picture Package Applications\Residence.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: RealGuide (HKLM)

Thanks
Post #2
Greetings and welcome to TomCoyote.org!

You've definitely got some infection going on. Let's try some "off the shelf" programs to see if we can "thin it down" a bit. :thumbup:

Please download and run Spybot-Search&Destroy and Ad-Aware; they are the standard programs for finding and cleaning malware off your system. Here are links to both programs, and instructions for their use.

Get Spybot - Search & Destroy from http://security.kolla.de
(This is the NEW Version 1.3)
Get AdAware SE Personal from http://www.lavasoft.de/support/download
(This is the NEW Build 1.05)

Download and install these programs if you don't already have them. If you do have them, make sure they are UPDATED AND CONFIGURED AS DESCRIBED here:

http://www.cjwd.demon.co.uk/spybot-adaware.html

Reboot after running each program.

Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
MOVE HijackThis into this folder.

If required a tutorial is here = Hijackthis Folder Tutorial

Then make a new log file, and "copy/paste" it into this thread, and we'll deal with any malware "leftovers". :)
Post #3
Thank you for the help. I really appreciate your time.
I ran both programs. I had them before, but I tried them again by downloading the new updated versions. However, I'm still having the same hijack problem. After about 20 minutes, explorer opens and takes me where I don't want to be… Here's the new Hijackthis Log.

Logfile of HijackThis v1.97.7
Scan saved at 10:24:32 AM, on 11/20/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\NETWOR~1\VIRUSS~1\AMGRSRVC.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\Network Associates\VirusScan NT\MCSHIELD.EXE
C:\PROGRA~1\NETWOR~1\VIRUSS~1\VSTSKMGR.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Network Associates\VirusScan NT\SHSTAT.EXE
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
C:\Program Files\USB Card Reader Driver v2.1g\Disk_Monitor.exe
C:\Program Files\QuickTime\qttask.exe
C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\llv4ut.exe
C:\WINNT\sy64or.exe
C:\WINNT\SPnt64ntSP.exe
C:\WINNT\64PEsyPEms.exe
C:\Program Files\OLYMPUS\CAMEDIA Master 4.2\CM_camera.exe
C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\hpodev07.exe
C:\picture package\Picture Package Menu\SonyTray.exe
C:\picture package\Picture Package Applications\Residence.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\MHPRMIND.EXE
C:\PROGRA~1\HEWLET~1\HPPSC7~1\bin\hpoevm07.exe
C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\HPOSTS07.exe
C:\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r2.attbi.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = sas.r2.attbi.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R3 - URLSearchHook: (no name) - {3E7FF0CC-708E-FD10-2E7F-22574FBB06A8} - C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\llv4ut.exe
F2 - REG:system.ini: UserInit=C:\WINNT\System32\userinit.exe,C:\WINNT\System32\svcinit.exe
N3 - Netscape 7: user_pref("browser.startup.homepage","www.yahoo.com"); (C:\Documents and Settings\Jason Oncay\Application Data\Mozilla\Profiles\default\fsfqmu9l.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_02.src"); (C:\Documents and Settings\Jason Oncay\Application Data\Mozilla\Profiles\default\fsfqmu9l.slt\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan NT\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINNT\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [Disk Monitor] C:\Program Files\USB Card Reader Driver v2.1g\Disk_Monitor.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ACCF94FE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\yisg8.exe
O4 - HKLM\..\Run: [9F5A5A6B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\j3k.exe
O4 - HKLM\..\Run: [982D4856] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\llv4ut.exe
O4 - HKLM\..\Run: [FE6DB06B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\jv4.exe
O4 - HKLM\..\Run: [8BADCDD3] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ja75ecdpi.exe
O4 - HKLM\..\Run: [A8FA82CB] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\1nsof0jnq8.exe
O4 - HKLM\..\Run: [0BAF9EFE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\0suj4ckzdik.exe
O4 - HKLM\..\Run: [E48B5B76] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\m97zo8xan11.exe
O4 - HKLM\..\Run: [41AF1666] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\67lwcicu7.exe
O4 - HKLM\..\Run: [DE59726B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\3pr.exe
O4 - HKLM\..\Run: [DA0DF086] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\2jyd51.exe
O4 - HKLM\..\Run: [003F4D56] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\2usb.exe
O4 - HKLM\..\Run: [E183CC43] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\xdlw.exe
O4 - HKLM\..\Run: [C119BCF6] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ko24e4z5y.exe
O4 - HKLM\..\Run: [8993D0DB] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\7zeo8q93.exe
O4 - HKLM\..\Run: [D0A44763] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\xsn4f3tryrmn.exe
O4 - HKLM\..\Run: [F4C79B5E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\g50u0sk4.exe
O4 - HKLM\..\Run: [DBB93E5E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\rcp6sku.exe
O4 - HKLM\..\Run: [AB7A7FDE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\sjr2i2uwcd.exe
O4 - HKLM\..\Run: [AF195B6B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\2xe.exe
O4 - HKLM\..\Run: [FF810953] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ikxryh0f3.exe
O4 - HKLM\..\Run: [81764A43] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\sgzo.exe
O4 - HKLM\..\Run: [EA4D7E4E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\q2alpatb8.exe
O4 - HKLM\..\Run: [AA0FBAEB] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\fyfk6.exe
O4 - HKLM\..\Run: [EA1B4DF3] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\9978ffck0ka.exe
O4 - HKLM\..\Run: [9EAE4203] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\de4tf2vq.exe
O4 - HKLM\..\Run: [EA6465EE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\77c3w.exe
O4 - HKLM\..\Run: [FECA010E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\uatoix.exe
O4 - HKLM\..\Run: [D9DA4456] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\cne6jl.exe
O4 - HKLM\..\Run: [4F5A5B66] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\93e.exe
O4 - HKLM\..\Run: [FFBA5A6E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\4oa.exe
O4 - HKLM\..\Run: [C0DF0C43] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\8f6v.exe
O4 - HKLM\..\Run: [5B7C55EE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ym99b1dr.exe
O4 - HKLM\..\RunServices: [SpoolService] spolsv.exe
O4 - HKCU\..\Run: [Explorer] C:\WINNT\System32\shellexp.exe en
O4 - HKCU\..\Run: [SpywareGuardPlus] C:\WINNT\system32\winmm64.exe
O4 - HKCU\..\Run: [sy64or] C:\WINNT\sy64or.exe
O4 - HKCU\..\Run: [SPnt64ntSP] C:\WINNT\SPnt64ntSP.exe
O4 - HKCU\..\Run: [ACCF94FE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\yisg8.exe
O4 - HKCU\..\Run: [64PEsyPEms] C:\WINNT\64PEsyPEms.exe
O4 - HKCU\..\Run: [9F5A5A6B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\j3k.exe
O4 - HKCU\..\Run: [982D4856] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\llv4ut.exe
O4 - HKCU\..\Run: [FE6DB06B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\jv4.exe
O4 - HKCU\..\Run: [8BADCDD3] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ja75ecdpi.exe
O4 - HKCU\..\Run: [A8FA82CB] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\1nsof0jnq8.exe
O4 - HKCU\..\Run: [0BAF9EFE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\0suj4ckzdik.exe
O4 - HKCU\..\Run: [E48B5B76] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\m97zo8xan11.exe
O4 - HKCU\..\Run: [41AF1666] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\67lwcicu7.exe
O4 - HKCU\..\Run: [DE59726B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\3pr.exe
O4 - HKCU\..\Run: [DA0DF086] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\2jyd51.exe
O4 - HKCU\..\Run: [003F4D56] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\2usb.exe
O4 - HKCU\..\Run: [E183CC43] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\xdlw.exe
O4 - HKCU\..\Run: [C119BCF6] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ko24e4z5y.exe
O4 - HKCU\..\Run: [8993D0DB] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\7zeo8q93.exe
O4 - HKCU\..\Run: [D0A44763] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\xsn4f3tryrmn.exe
O4 - HKCU\..\Run: [F4C79B5E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\g50u0sk4.exe
O4 - HKCU\..\Run: [DBB93E5E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\rcp6sku.exe
O4 - HKCU\..\Run: [AB7A7FDE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\sjr2i2uwcd.exe
O4 - HKCU\..\Run: [AF195B6B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\2xe.exe
O4 - HKCU\..\Run: [FF810953] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ikxryh0f3.exe
O4 - HKCU\..\Run: [81764A43] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\sgzo.exe
O4 - HKCU\..\Run: [EA4D7E4E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\q2alpatb8.exe
O4 - HKCU\..\Run: [AA0FBAEB] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\fyfk6.exe
O4 - HKCU\..\Run: [EA1B4DF3] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\9978ffck0ka.exe
O4 - HKCU\..\Run: [9EAE4203] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\de4tf2vq.exe
O4 - HKCU\..\Run: [EA6465EE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\77c3w.exe
O4 - HKCU\..\Run: [FECA010E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\uatoix.exe
O4 - HKCU\..\Run: [D9DA4456] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\cne6jl.exe
O4 - HKCU\..\Run: [4F5A5B66] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\93e.exe
O4 - HKCU\..\Run: [FFBA5A6E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\4oa.exe
O4 - HKCU\..\Run: [C0DF0C43] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\8f6v.exe
O4 - HKCU\..\Run: [5B7C55EE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ym99b1dr.exe
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Startup: Microsoft Greetings Reminders.lnk = C:\Program Files\MHPRMIND.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: CAMEDIA Master.lnk = C:\Program Files\OLYMPUS\CAMEDIA Master 4.2\CM_camera.exe
O4 - Global Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\hpodev07.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Picture Package Menu.lnk = C:\picture package\Picture Package Menu\SonyTray.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = C:\picture package\Picture Package Applications\Residence.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: RealGuide (HKLM)


Thanks again
Post #4
Well, it appears the "off the shelf" programs haven't done a great deal as I had hoped. :(

So let's just dive right in and get you cleaned up. :thumbup:

Please download the latest version of Hijack This!

Links to Hijack This! v 1.98.2:

http://tools.radiosplace.com/HijackThis.exe
http://spywarewarrior.com/files/HijackThis.exe

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Scan".
Then "check" the box to the left of these item(s):

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank

R3 - URLSearchHook: (no name) - {3E7FF0CC-708E-FD10-2E7F-22574FBB06A8} - C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\llv4ut.exe

F2 - REG:system.ini: UserInit=C:\WINNT\System32\userinit.exe,C:\WINNT\System32\svcinit.exe

O4 - HKLM\..\Run: [ACCF94FE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\yisg8.exe

O4 - HKLM\..\Run: [9F5A5A6B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\j3k.exe

O4 - HKLM\..\Run: [982D4856] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\llv4ut.exe

O4 - HKLM\..\Run: [FE6DB06B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\jv4.exe

O4 - HKLM\..\Run: [8BADCDD3] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ja75ecdpi.exe

O4 - HKLM\..\Run: [A8FA82CB] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\1nsof0jnq8.exe

O4 - HKLM\..\Run: [0BAF9EFE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\0suj4ckzdik.exe

O4 - HKLM\..\Run: [E48B5B76] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\m97zo8xan11.exe

O4 - HKLM\..\Run: [41AF1666] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\67lwcicu7.exe

O4 - HKLM\..\Run: [DE59726B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\3pr.exe

O4 - HKLM\..\Run: [DA0DF086] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\2jyd51.exe

O4 - HKLM\..\Run: [003F4D56] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\2usb.exe

O4 - HKLM\..\Run: [E183CC43] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\xdlw.exe

O4 - HKLM\..\Run: [C119BCF6] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ko24e4z5y.exe

O4 - HKLM\..\Run: [8993D0DB] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\7zeo8q93.exe

O4 - HKLM\..\Run: [D0A44763] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\xsn4f3tryrmn.exe

O4 - HKLM\..\Run: [F4C79B5E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\g50u0sk4.exe

O4 - HKLM\..\Run: [DBB93E5E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\rcp6sku.exe

O4 - HKLM\..\Run: [AB7A7FDE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\sjr2i2uwcd.exe

O4 - HKLM\..\Run: [AF195B6B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\2xe.exe

O4 - HKLM\..\Run: [FF810953] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ikxryh0f3.exe

O4 - HKLM\..\Run: [81764A43] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\sgzo.exe

O4 - HKLM\..\Run: [EA4D7E4E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\q2alpatb8.exe

O4 - HKLM\..\Run: [AA0FBAEB] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\fyfk6.exe

O4 - HKLM\..\Run: [EA1B4DF3] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\9978ffck0ka.exe

O4 - HKLM\..\Run: [9EAE4203] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\de4tf2vq.exe

O4 - HKLM\..\Run: [EA6465EE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\77c3w.exe

O4 - HKLM\..\Run: [FECA010E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\uatoix.exe

O4 - HKLM\..\Run: [D9DA4456] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\cne6jl.exe

O4 - HKLM\..\Run: [4F5A5B66] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\93e.exe

O4 - HKLM\..\Run: [FFBA5A6E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\4oa.exe

O4 - HKLM\..\Run: [C0DF0C43] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\8f6v.exe

O4 - HKLM\..\Run: [5B7C55EE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ym99b1dr.exe

O4 - HKLM\..\RunServices: [SpoolService] spolsv.exe

O4 - HKCU\..\Run: [Explorer] C:\WINNT\System32\shellexp.exe en

O4 - HKCU\..\Run: [SpywareGuardPlus] C:\WINNT\system32\winmm64.exe

O4 - HKCU\..\Run: [sy64or] C:\WINNT\sy64or.exe

O4 - HKCU\..\Run: [SPnt64ntSP] C:\WINNT\SPnt64ntSP.exe

O4 - HKCU\..\Run: [ACCF94FE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\yisg8.exe

O4 - HKCU\..\Run: [64PEsyPEms] C:\WINNT\64PEsyPEms.exe

O4 - HKCU\..\Run: [9F5A5A6B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\j3k.exe

O4 - HKCU\..\Run: [982D4856] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\llv4ut.exe

O4 - HKCU\..\Run: [FE6DB06B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\jv4.exe

O4 - HKCU\..\Run: [8BADCDD3] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ja75ecdpi.exe

O4 - HKCU\..\Run: [A8FA82CB] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\1nsof0jnq8.exe

O4 - HKCU\..\Run: [0BAF9EFE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\0suj4ckzdik.exe

O4 - HKCU\..\Run: [E48B5B76] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\m97zo8xan11.exe

O4 - HKCU\..\Run: [41AF1666] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\67lwcicu7.exe

O4 - HKCU\..\Run: [DE59726B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\3pr.exe

O4 - HKCU\..\Run: [DA0DF086] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\2jyd51.exe

O4 - HKCU\..\Run: [003F4D56] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\2usb.exe

O4 - HKCU\..\Run: [E183CC43] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\xdlw.exe

O4 - HKCU\..\Run: [C119BCF6] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ko24e4z5y.exe

O4 - HKCU\..\Run: [8993D0DB] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\7zeo8q93.exe

O4 - HKCU\..\Run: [D0A44763] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\xsn4f3tryrmn.exe

O4 - HKCU\..\Run: [F4C79B5E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\g50u0sk4.exe

O4 - HKCU\..\Run: [DBB93E5E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\rcp6sku.exe

O4 - HKCU\..\Run: [AB7A7FDE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\sjr2i2uwcd.exe

O4 - HKCU\..\Run: [AF195B6B] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\2xe.exe

O4 - HKCU\..\Run: [FF810953] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ikxryh0f3.exe

O4 - HKCU\..\Run: [81764A43] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\sgzo.exe

O4 - HKCU\..\Run: [EA4D7E4E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\q2alpatb8.exe

O4 - HKCU\..\Run: [AA0FBAEB] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\fyfk6.exe

O4 - HKCU\..\Run: [EA1B4DF3] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\9978ffck0ka.exe

O4 - HKCU\..\Run: [9EAE4203] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\de4tf2vq.exe

O4 - HKCU\..\Run: [EA6465EE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\77c3w.exe

O4 - HKCU\..\Run: [FECA010E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\uatoix.exe

O4 - HKCU\..\Run: [D9DA4456] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\cne6jl.exe

O4 - HKCU\..\Run: [4F5A5B66] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\93e.exe

O4 - HKCU\..\Run: [FFBA5A6E] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\4oa.exe

O4 - HKCU\..\Run: [C0DF0C43] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\8f6v.exe

O4 - HKCU\..\Run: [5B7C55EE] C:\DOCUME~1\JASONO~1\LOCALS~1\Temp\ym99b1dr.exe

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Then click "Fix checked".

Reboot in "safe" mode.

Find and delete:

Delete all files in this FOLDER:

c:\documents and settings\jasono~1\local settings\temp <— FOLDER

c:\winnt\64pesypems.exe <— file

c:\winnt\spnt64ntsp.exe <— file

c:\winnt\sy64or.exe <— file

c:\winnt\system32\shellexp.exe <— file

c:\winnt\system32\winmm64.exe <— file

spolsv.exe <— file
(use windows explorer to find)

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread. :)
Post #5
Thanks again for all of your help. I could not find

c:\winnt\system32\shellexp.exe <— file

c:\winnt\system32\winmm64.exe <— file

spolsv.exe <— file
(use windows explorer to find)

They didn't seem to exist in the system32 folders. Also,
I can see that spolsv.exe is a process in the task manager, but I can't
find it anywhere with windows explorer, and the task manager won't
let me "end process." It says, "access denied."

I cleared everything else, and here's the new log.

Logfile of HijackThis v1.97.7
Scan saved at 1:07:17 PM, on 11/20/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\NETWOR~1\VIRUSS~1\AMGRSRVC.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\Network Associates\VirusScan NT\MCSHIELD.EXE
C:\PROGRA~1\NETWOR~1\VIRUSS~1\VSTSKMGR.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Network Associates\VirusScan NT\SHSTAT.EXE
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
C:\Program Files\USB Card Reader Driver v2.1g\Disk_Monitor.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\OLYMPUS\CAMEDIA Master 4.2\CM_camera.exe
C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\hpodev07.exe
C:\picture package\Picture Package Menu\SonyTray.exe
C:\picture package\Picture Package Applications\Residence.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\MHPRMIND.EXE
C:\PROGRA~1\HEWLET~1\HPPSC7~1\bin\hpoevm07.exe
C:\WINNT\system32\hpoipm07.exe
C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\HPOSTS07.exe
C:\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r2.attbi.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = sas.r2.attbi.com
N3 - Netscape 7: user_pref("browser.startup.homepage","www.yahoo.com"); (C:\Documents and Settings\Jason Oncay\Application Data\Mozilla\Profiles\default\fsfqmu9l.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_02.src"); (C:\Documents and Settings\Jason Oncay\Application Data\Mozilla\Profiles\default\fsfqmu9l.slt\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan NT\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINNT\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [Disk Monitor] C:\Program Files\USB Card Reader Driver v2.1g\Disk_Monitor.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Startup: Microsoft Greetings Reminders.lnk = C:\Program Files\MHPRMIND.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: CAMEDIA Master.lnk = C:\Program Files\OLYMPUS\CAMEDIA Master 4.2\CM_camera.exe
O4 - Global Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\hpodev07.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Picture Package Menu.lnk = C:\picture package\Picture Package Menu\SonyTray.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = C:\picture package\Picture Package Applications\Residence.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: RealGuide (HKLM)


Anything else I need to worry about?
This is helping to end my frustration! Thanks for the advice.

J.
Post #6
CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Scan".
Then "check" the box to the left of these item(s):

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

Then click "Fix checked".

Reboot and "copy/paste" a new log file into this thread. :)

Are you certain that the task you are trying to "end" is "spolsv.exe"?

Are you sure it's not "spoolsv.exe" (note the TWO o's)?
(This is a "good" process)

:unsure:
Post #7
I can't seem to make those files go away… I have tried the "fix" and reboot several times, but they reappear. In the meantime, I haven't had any other hijackings. And you were right about the "spoolsv.exe"
Here's the new log… Thanks again for all of your help!

Logfile of HijackThis v1.97.7
Scan saved at 10:51:50 PM, on 11/23/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\PROGRA~1\NETWOR~1\VIRUSS~1\AMGRSRVC.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\Network Associates\VirusScan NT\MCSHIELD.EXE
C:\PROGRA~1\NETWOR~1\VIRUSS~1\VSTSKMGR.EXE
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Network Associates\VirusScan NT\SHSTAT.EXE
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
C:\Program Files\USB Card Reader Driver v2.1g\Disk_Monitor.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\OLYMPUS\CAMEDIA Master 4.2\CM_camera.exe
C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\hpodev07.exe
C:\picture package\Picture Package Menu\SonyTray.exe
C:\picture package\Picture Package Applications\Residence.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\MHPRMIND.EXE
C:\PROGRA~1\HEWLET~1\HPPSC7~1\bin\hpoevm07.exe
C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\HPOSTS07.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r2.attbi.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = sas.r2.attbi.com
N3 - Netscape 7: user_pref("browser.startup.homepage","www.yahoo.com"); (C:\Documents and Settings\Jason Oncay\Application Data\Mozilla\Profiles\default\fsfqmu9l.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_02.src"); (C:\Documents and Settings\Jason Oncay\Application Data\Mozilla\Profiles\default\fsfqmu9l.slt\prefs.js)
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan NT\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [HPAIO_PrintFolderMgr] C:\WINNT\System32\spool\DRIVERS\W32X86\hpoopm07.exe
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKLM\..\Run: [Disk Monitor] C:\Program Files\USB Card Reader Driver v2.1g\Disk_Monitor.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Startup: Microsoft Greetings Reminders.lnk = C:\Program Files\MHPRMIND.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: CAMEDIA Master.lnk = C:\Program Files\OLYMPUS\CAMEDIA Master 4.2\CM_camera.exe
O4 - Global Startup: HPAiODevice.lnk = C:\Program Files\Hewlett-Packard\hp psc 700 series\bin\hpodev07.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Picture Package Menu.lnk = C:\picture package\Picture Package Menu\SonyTray.exe
O4 - Global Startup: Picture Package VCD Maker.lnk = C:\picture package\Picture Package Applications\Residence.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: RealGuide (HKLM)
Post #8
It appears those two lines aren't going to go away.

They're not an "infection", fixing them was more of a "cleanup".

So, unless you're still having problems, we'll call this one "solved".

God bless!!!!

M68 :)

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?" here:

http://boards.cexx.org/viewtopic.php?t=957

Download IE-Spyad here:

https://netfiles.uiuc.edu/ehowes/www/resource.htm

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings here:

http://browsercheck.qualys.com/index.php

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.

Post #9
This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI