What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijack This Log

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi,

Here is my hijackthis log for my win2k pro pc. I have run Housecall, AdAware SE, spybot search and destroy, and housecall again per the instructions I found in this recent thread here on this board. The first time I ran housecall it found a TROJ_STUBBY.B file which it said it couldn't clean but it did allow me to delete the file. Now when I run it it says there are no problems.

What I'm experiencing is: A windows installer dialog box keeps appearing, flashing, then going away on its own at startup and everytime I open an ie window, no matter how many I have open the installer dialog appears and goes away for each one(though the ie window works after that(sort of)); I can't type in any text input fields in ie windows(like a google search or forum post), I can type in the address bar and I can click inside a window, but the cursor doesn't appear there, and I can't get the cursor to any text input fields in ie by tabbing to them, though I can click on simple hyperlinks and they work; when I go help->about in ie it says ie5(though I was pretty sure I had installed ie6), but when I try to download automatic updates, it tries to give me security updates for ie6 and a security update for the jvm fails(sorry I don't remember the exact text); also when I do help->about in ie it shows the about box but an error dialog appears over it saying "An error has occurred in this dial, Error 84, unspecified error", when I do Edit->Find I get the same exact dialog except 84 is replaced with 39; when I try to manually run the Windows update webpage nothing heppens when I click on the 'scan for updates' link; and lastly, when I open add/remove programs in control panel, the icons are shown for all of my programs but no text appears next to them.

I had a nvidia graphics driver installation blow up a while ago(though I don't know if this is the cause or if it started then), and at one point when I was recklessly trying to fix this manually it was asking for a .msi file at startup(which has since stopped), also my (ex)girlfriend infected that pc with spyware repeatedly, though I think it's all gone(I have defintely done the ad aware and spybot with your methods here so it should be, right?), there are some quarantines laying around. Msconfig is running on that pc I think to prevent some of that stuff. I hope this ins't annoyingly too much info. Thanks!



Logfile of HijackThis v1.99.0
Scan saved at 4:23:18 PM, on 12/26/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\cisvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
C:\WINNT\System32\MsiExec.exe
C:\Downloads\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AT&T Broadband Internet
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [MSConfig] C:\Documents and Settings\Administrator\Desktop\msconfig.exe /auto
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://support.gateway.com/support/profiler/PCPitStop.CAB
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {E87A6788-1D0F-4444-8898-1D25829B6755} - http://fdl.msn.com/public/chat/msnchat4.cab
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTsvcCDA.EXE
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe
Post #3
Hello InsaneGamer , welcome to the TC.

I'm really curious about having Msconfig on Windows 2000. As far I as I know msconfig wasn't part of that operating system. Do a search for msconfig and let me know what you find.


I suggest you do this:

Run Hijack This again and put a check by these.

R3 - Default URLSearchHook is missing

O4 - HKLM\..\Run: [LoadQM] loadqm.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"


Restart your computer in Safe Mode

Press the F8 key, when you see the Starting Windows bar at the bottom of the screen.

Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.


1. Open My Computer
2. Right click on your hard drive that you wish to clean (C drive, for example)
3. In the context menu that opens, select properties
4. Under the general tab you should select Disk Cleanup
5. Windows will scan your drive which will take a few seconds/minutes
6. A box will display the various files you can remove.
Check all boxes except compress old files (If listed)
7. Click OK and windows will comply.

Restart your computer.

Reboot and "copy/paste" a new log file into this thread.
Post #4
Thanks! OK I will do that ASAP. I think you're right msconfig wasn't included in win2k pro but it's definitely running at every boot. The file is actually located in Documents and Settings/User/desktop, so that pretty much looks like it came from somewhere else. It's definitely working because I can see the precesses that don't run listed in it. I think I sought it out after I couldn't get some real or quicktime or creative processes not to start on that pc 800 mhz machine with 384 mb pc 100 <_<
Post #6
I have done the disk cleanup like you said, here is my new log. Thanks for your help, I really appreciate it. I'm kind of curious about this line from the log O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll. The windows installer is still running crazy :(


Logfile of HijackThis v1.99.0
Scan saved at 5:27:42 PM, on 12/31/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\cisvc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\System32\MsiExec.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
C:\Downloads\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by AT&T Broadband Internet
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [MSConfig] C:\Documents and Settings\Administrator\Desktop\msconfig.exe /auto
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll
O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {E87A6788-1D0F-4444-8898-1D25829B6755} - http://fdl.msn.com/public/chat/msnchat4.cab
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\System32\CTsvcCDA.EXE
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe
Post #7

I'm kind of curious about this line from the log O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

NPDocBox.dll is a module related to Adobe Acrobat and provides a plugin for both Netware (if installed) and Internet Explorer.

Your log looks good. Do you have items disabled in Msconfig? If so, enable them and Reboot and "copy/paste" a new log file into this thread.
Post #8
But I haven't turned anything off in msconfig for over a year… and I haven't turned anything on in there either. This persistent installer problem is new. Worst of all I think many of the unchecked items are spyware that may have been removed by adaware or spybot, right? I wish I could paste a screenshot in here of it. I don't mean to argue with you while you're helping me, but here is a list of the startup items in msconfig(only the first 4 are enabled:
  • mobsync
  • point32
  • zlclient
  • eventsvc
  • Schedule(Asus Digital VCR)
  • Sync(clock sync)
  • livenote
  • loadqm
  • nmebvh
  • qttask
  • Sentry
  • an item with no name or command shown in msconfig but is HKLM../Run
  • trunk32host
  • eventsvc
  • TVMD
  • VBouncerInner1203
  • Weather
  • Save
  • XTCfgLoader
  • XupiterStart2003
  • MicrosoftOffice
Post #9

What I'm experiencing is: A windows installer dialog box keeps appearing, flashing, then going away on its own at startup and everytime I open an ie window, no matter how many I have open the installer dialog appears and goes away for each one(though the ie window works after that(sort of));


This is a indication of a failed installation. I've seen this with MSOffice before. My guess is that it's a failed IE install / upgrade.

1).Try going to Add / Remove Programs and click remove on IE and select repair.

OR

2). Go HERE and download FireFox and try that instead of IE.

Then remove IE all together. Then visit windows and download IE again.


The listing in Msconfig only indicates those programs were once installed and running.
Post #10

What I'm experiencing is: A windows installer dialog box keeps appearing, flashing, then going away on its own at startup and everytime I open an ie window, no matter how many I have open the installer dialog appears and goes away for each one(though the ie window works after that(sort of));


This is a indication of a failed installation. I've seen this with MSOffice before. My guess is that it's a failed IE install / upgrade.

1).Try going to Add / Remove Programs and click remove on IE and select repair.

OR

2). Go HERE and download FireFox and try that instead of IE.

Then remove IE all together. Then visit windows and download IE again.


The listing in Msconfig only indicates those programs were once installed and running.


I would very much love to do a full reinstall of ie, can you uninstall it in add/remove programs?
Post #11

I would very much love to do a full reinstall of ie, can you uninstall it in add/remove programs?

Yes you should be able to.
Did you download FireFox? I'd do that first.
Post #12
If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI