What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

I Think I've Been Hijacked

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My computer's been running slower than usual these days. When I'm doing a search on Google a window comes up and says that this site cannot be found. I have to restart and only then am I able to access that site. Also, when I start the computer, it seems to take longer to load and the screen will start to jitter. I am using Spyblaster. Spybot, Zone Alarm and Avast anti-viirus. I've scanned for viruses and found nothing. Scanned Spybot and DSO Exploit keeps reappearing after I fixed the problem.

I purchased this computer about a month ago with XP installed, used Internet Explorer until a few weeks ago then changed over to Mozilla. I would like to uninstall EI all together if possible.

Here's an HJT Log I ran today. (Why is it showing MSIE when I am using Mozilla?)

Hope you can help me. Thanks


Logfile of HijackThis v1.99.0
Scan saved at 11:54:10 AM, on 12/02/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Robert Huculak\Local Settings\Temp\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.shaw.ca/start/enca
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.mdg.ca
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Error Nuker] C:\Program Files\Error Nuker\bin\ErrorNuker.exe autostart
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http:\\www.mdg.ca
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF05F500-7F08-4EB1-B630-FF78A0269032}: NameServer = 192.168.1.254
O23 - Service: avast! iAVS4 Control Service - Unknown - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService - Intel® Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #2
Hello Dorowest,

I am currently reviewing your HiJackThis log and will post back shortly.

Thank you for your patience.

To answer some of your questions:

The DSO exploit problem is to do with Spybot itself, and will be fixed in
later versions.

Before doing anything with Internet Explorer please check out this link
from Microsoft and read carefully:
http://support.microsoft.com/default.aspx?…b;EN-US;q293907

HijackThis reports IE as your browser by default. It does not look to
see if you are using any other browsers and report it in the header,
but you can see it if you look closely at your log.

Moving to Firefox is a good move in my opinion, I use it also almost
exclusively now. Although there are times when I still use IE for certain
things. But again, please refer to the article by MS on this before taking
any action.

Regards,

Dave
Post #3
Hello Dorowest,

Sorry for the delay in getting back to you. As you may have noticed the
forums have been down for an upgrade. Thank you for waiting.

Your log is clean from any Malware infections.

I would recommend fixing the following items in HijackThis. They are not Malware but are
considered resource hogs and removal should enhance the performance of your system.

Run HijackThis and put a check next to these items.

O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

Now close all browser and explorer windows, and tell HijackThis to "Fix checked". Then Reboot:

I also recommend cleaning out your temporary internet files. CCleaner is a
freeware system optimisation tool for PCs. It removes unnecessary junk
from your computer allowing it to run more efficiently and securely.
Please download CCleaner from one of the two websites below:
http://www.majorgeeks.com/download4191.html
http://www.ccleaner.com/

Install CCleaner. Now open and click on the Windows tab.
Check the following items:
Under Internet Explorer:
Temporary Internet Files
History
Recently Typed URLs
Delete Index.dat files
Under System:
Empty Recycle Bin
Temporary Files
Memory Dumps
Chkdsk File Fragments
Old Prefetch Data

Next: click the Options button and then click the Settings tab
Uncheck: Only delete files older than 48 hrs. and click OK

Prior to running click on the Check for updates now… link
Then click the Run Cleaner button. It should only take a few seconds
to complete and exit when it is done.

In addition to updating and running the tools you current have I also
recommend using SpywareGuard. SpywareGuard provides a real-time
protection solution against spyware that is a great addition to SpywareBlaster's
protection method. You can download SpywareGuard here:
http://www.javacoolsoftware.com/sgdownload.html
A tutorial on installing & using this product can be found here:
http://www.bleepingcomputer.com/forums/tutorial50.html

Hopefully following these steps will improve your performance. If you have
any questions please feel free to ask.

If you are still having problems after these changes check out PCPitstop to
see if they can help with your problems.

You also mentioned you purchased the computer only one month ago.
If you still have problems I would suggest bringing it to the store you
bought it from for repair, if possible, or returning it as I would hope it
would still be under warrantee.

Regards,

Dave
Post #4
Hi Dave, Thanks so much for your assistance. I'm just glad you could help out. At least there wasn't any nasty stuff in the machine. I fixed the 3 items with HJT, did a clean with CCleaner and removed 116.1MB of temporary files. My machine is up and running smoother and web pages are also loading faster. It's like I'm back in the Caddy again. I still have one little quick flicker on my screen when the Inbox of Outlook Express come up. I'll take it in and get it checked out. Best Regards, DoroWest

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI