What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Logfile 02/02/2005

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.99.0
Scan saved at 14:36:22, on 01.02.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Explorer.EXE
E:\Programme\AVPersonal\AVWUPSRV.EXE
E:\Programme\Zone Labs\ZoneAlarm\zlclient.exe
E:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
E:\Programme\Java\jre1.5.0\bin\jusched.exe
E:\Programme\AVPersonal\AVGNT.EXE
E:\WINDOWS\System32\ctfmon.exe
E:\Programme\Microsoft Office\Office\FINDFAST.EXE
E:\Programme\Microsoft Office\Office\OSA.EXE
E:\WINDOWS\system32\ZoneLabs\vsmon.exe
E:\Programme\BOINC\boinc_gui.exe
E:\Programme\AVPersonal\AVGUARD.EXE
E:\Programme\Mozilla Firefox\firefox.exe
E:\Programme\BOINC\projects\setiathome.berkeley.edu\setiathome_4.08_windows_intelx86.exe
D:\DOWNLOAD\HijackThis-1.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.de/0SEDEDE/SAOS01
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - E:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Zone Labs Client] "E:\Programme\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] E:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Programme\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [XTIC] e:\programme\lg xtick2.91\xtick.exe sys_auto_run E:\Programme\LG XTICK2.91
O4 - HKLM\..\Run: [AVGCtrl] E:\Programme\AVPersonal\AVGNT.EXE /min
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\RunOnce: [ICQ Lite] E:\Programme\ICQLite\ICQLite.exe -trayboot
O4 - Startup: Microsoft-Indexerstellung.lnk = E:\Programme\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office-Start.lnk = E:\Programme\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O8 - Extra context menu item: Download with Star Downloader - E:\PROGRA~1\STARDO~1\sdie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Programme\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Programme\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: ICQ 4.1 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Programme\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - E:\Programme\ICQLite\ICQLite.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1103554824180
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…418/mcfscan.cab
O23 - Service: AntiVir Service - H+BEDV Datentechnik GmbH - E:\Programme\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update - H+BEDV Datentechnik GmbH, Germany - E:\Programme\AVPersonal\AVWUPSRV.EXE
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - E:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #3
FOGOMAINS,

Welcome to Tom Coyote,

I really don't see to much wrong with your log. Could you post back with any problems that you re having.

Hijackthis needs to be in its own folder, you can click on the link at the bottom of my post to download the zipped version.

It will by default install it in C:\PROGRAM FILES\ HIJACKTHIS. and this is exactly where we want it to be.

Run HJT, close all open windows and web browsers and put a checkmark in the following entries and click on the FIX button.

* O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm

* O9 - Extra button: (no name) - {FB5F1910-F110-11d2-BB9E-00C04F795683} - (no file)

I would advise you to install Service Pack 2 (SP2), it will greatly enhance the security of your computer.

Just go to START/ ALL PROGRAMS/ WINDOWS UPDATE and install all the CRITICAL UPDATES that are available including SP2. DONOT INSTALL ANY DRIVER FILES FOR YOUR SYSTEM. If you wish, you can go here WinXp Home and order it on a CD.


Please post back with any concerns that you have that are either Malware or Virus related.

Ken545
Post #4
Thanks Ken545, i re-installed HighJackThis and fixed 1 entry. Didn't get O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - E:\WINDOWS\web\related.htm I tried to install SP2 before, but got problems with my graphics-card NVIDIA FX440 (Didn't pass MS Logo-test). Downloaded the driver-update and tried to install SP2 again. Got a blue screen :( Switched back to SP1 :unsure:
Post #5
Hi Ken545, the video adapter is a : nVIDIA GeForce FX 5200LE I deactivated the adapter and tried again to install SP2. Got a message: didn't pass MS logo-test :unsure:
Post #6
FOGOMAINS,

Your log looks free of any viruses and Malware, installing SP2 is critical to the security of your system. There are many issues installing SP2 because some hardware componants, or software programs are not compatable. Most manufacturers have patches for there products to get around this. I would suggest that you visit the nVidia website under the support section and they may have some suggestions or patches for this problem.

http://www.nvidia.com/page/home

You can also visit these TECH SUPPORT SITES that specialize in Hardware and Software problems, they are free and I am sure that you can find the help you need in there. I am sorry I can't help you futher as the Tom Coyote support forums are just for the removal of Viruses and Malware.

http://pcpitstop.ibforums.com/index.php?showforum=3

http://hwg.mazin.net/hardwareguys/hwgboard/ikonboard.cgi

Thanks for using Tom Coyote,

Ken545
Post #8
If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI