What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Need Help To Action Hijackthis Logs

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
:blink: " I'm confussed "

I'm new to using HijackThis…this system has been completed formated and reloaded and updated and all applications installed that are needed for now.

I've run the HiJackThis to generate the log below and would like help in determining what items I can safely add to the Ignore List and which items I should be letting HijackThis take care of.

You assistance will be greatly appreciated.

In the meantime…..I'm trying to educate myself on the different objects detected and cross reference them with my applications installed.

Here's the logfile:

Logfile of HijackThis v1.99.1
Scan saved at 9:12:24 AM, on 4/17/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WASAY\PROMAGIC\wspmsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\EPoX\USDM\USDM.EXE
C:\Program Files\ImageIt\ItRun.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Wasay\ProMagic\Plus.exe
C:\WINDOWS\system32\wpabaln.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\4hire\Desktop\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [EPoXUSDM] "C:\Program Files\EPoX\USDM\USDM.EXE" "5000"
O4 - HKLM\..\Run: [WinIt] C:\Program Files\ImageIt\ItRun.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Pro Magic Plus.lnk = C:\WASAY\PROMAGIC\PlusStart.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1113564516387
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WasayPMsv - Unknown owner - C:\WASAY\PROMAGIC\wspmsv.exe
Post #2
Hello 4hire, Welcome to TomCoyote forum. Let me see if I can help with your confusion. Since your log is clean of malware and the only issue I see is a poorly placed HJT.exe and this information will help you correct that: http://www.bleepingcomputer.com/forums/tutorial94.html Ifyou ever use your HJT.exe you will need the folder described in the link to store HJT.exe, logs and backups for safety.

I've run the HiJackThis to generate the log below and would like help in determining what items I can safely add to the Ignore List and which items I should be letting HijackThis take care of.

1) I am not sure what you are referring to by "ignore list", please give me more information and I may be able to help?

2) As far as "letting HJT take care of", keep in mind that HJT of itself does nothing. It is a diagnostic and evaluation tool that is used by folks who are trained to make necessary adjustments to remove malware and other bad stuff from your computer. It give us basically a snapshot of certain areas that the malware writers use most (this is always changing) and allows us to use the process manager and other tools built into HJT to remove these offending items. HJT does nothing on its own and it does not run.
I hope this is the information you were looking for. Now if you are trying to decide what is valid and what is not by looking at the log, this takes a lot of training. In your case there is no malware, to spot items of malware as I said requires this training. Here are some of the tools used to identify the items in the log if it help:
http://www.answersthatwork.com/Tasklist_pages/tasklist.htm
http://www.pacs-portal.co.uk/startup_index.htm
http://computercops.biz/StartupList.html
http://www.sysinfo.org/startuplist.php
http://www.bleepingcomputer.com/startups/

I will take advantage of the fact that you have a clean computer to give you the information I give everyone once cleanup is completed:
Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://forums.net-integration.net/index.php?showtopic=3051
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html

I hope this is the information you were looking for.

Thanks…pskelley
TomCoyote forum
Slyware Warrior
Post #3
Hi PSKELLYEY….Thanks for the quick response. What I was referring to in the " Ignore List " … there's a section when you open the Hijackthis called CONFIG … when you press this button, there are other options and one of these is the IGNORE LIST….I was wondering from my logfile if I could place these objects or applications into it and how that was to be done….this way these would not be scanned everytime. Can you help me here. Thanks for the other links and I will start to review them. I was just hoping that I could get a good snapshot of the system and have things in place….so if and when things start to give me a problem in the future, that I'd have a good base to refer back to in Hijackthis. Hope you can help and thanks
Post #4
Hi again, here a good tutorial, but with a quick look I don't think it covers the ignore area either:
http://www.bleepingcomputer.com/forums/ind…showtutorial=42

The information right under the IgnoreList button does cover it very well though. I do not use the tool, but I may…lol, I look at my HJT log about every day. Keep in mind that I take my computer places in searching for what is bad in the log the average person would not, hence my concern for keeping an eye on the log. While I am using advanced tools that highlite bad areas so they can be spotted at a glance, the average "advanced" user would not have access to these tools. I could see the ignore list being created of items you know from experience are valid so that when you run a scan you do not have to view those items and the list would then be very short or even only anything bad that had shown up. I would say you could copy/paste the line items right from your logfile in the HJT folder.
Others will more than likely be glancing at this post and I am sure if anyone can add to this information, and I encourage them to so so, they will. I hope this helps.
pskelley
HJT team
Post #5
:) thanks pskelley I will probably being checking it like you quite often and experimenting with it also in those " not so nice places " …. I forgot to mention that I've been a service technician for over 20 years…. but mostly in the confines of companies and these last couple of years I've been servicing " home users " and learning and understanding and using this tool " hijackthis " should be most benificial to me. :rofl: now that's once I actually start learning it properly * if anyone else can help or point me in the right direction for learning this tool as a service technician would….. I'd love you to bits :weee:
Post #7
Thank you so very much …… I've requested the "classroom" and hopefully they accept me. quick question: I've checked through my system and noticed a process running called: spider.exe I've checked the Internet through the sites you had provided and can not seem to find anything on this process. Hijackthis did not pick it up either. FaberToys is the one that has brought this process to my attention. It seems to be part of XP sp2 and is being initated by Explorer.exe I've seen this on other people's system and never knew if it's suppose to be there or not and what is it. Do you have any ideas or suggestions?
Post #8
Good luck on your application for classroom :thumbup:

quick question: I've checked through my system and noticed a process running called: spider.exe

This could be many things, try searching Google. Please note that this running process was NOT showing in the log you provided this morning. I suggest since you have the exact name of the item that you use search to find the location, navigate to the location and investigate the properties of the item to see if that helps ID it. Since I am running the same Operating System I will tell you a simple search on my machine returns C:\Windows\System32\spider.exe which is one of the solitaire games installed on many WinXp computers. Keep in mind that a game like solitaire, will not appear in running processes when closed. Now if someone uses the game and does not close it, then it will appear in running processes until it is closed. It gets more complex from there…lol.
I have no idea what this is: FaberToys , I would need more information…name and location.
pskelley
Post #9
oh…sorry…thought one of your links had pointed me to the FaberToys…but I guess it was my surfin that stumbled upon it……here's the link

http://www.faberbox.com/fabertoys.asp?action=download

it's more of a GUI friendly app.

interesting enough….I've since run it several times and the spider.exe was showing up, but it has not in the last two runs of fabertoys. I've not closed any of my applications throughout all these scans….what I've got running is :
several IE windows, outlook, media player, hijackthis, fabertoys, and my documents.
*** what ever that process was attached to has disappeared….but the Fabertoys did indicate it was with explorer.exe …. so I'm wondering if My Documents has something…..checked it out and found a file called: spider.sav

the spider.sav is 372 bytes created 01march 2005 accessed 17april2005
** there's no file association to it **

ummm…. now I'm wondering what it is…… :unsure:
Post #10
Humm…not much information to go on:

the spider.sav  is 372 bytes    created  01march 2005  accessed 17april2005
** there's no file association to it **

That is all there is in properties? Here is information I located, you know your computer better than me so it will help you more than me.

http://www.modem-drivers.com/drivers/78/78673.htm
is this your driver??

I will just give you the link:
http://www.modem-drivers.com/drivers/78/78673.htm

Can you tell anything by the dates? You know when you reformated. Hard for me to advise you from here (Clearwater, Florida). I can give you an address where you can submiut it for inspection if you want? If you computer is running ok, you can just keep an eye on it.
I am going to say if this is your modem, then this is the item: 3Com US robotic 56K v90 driver - 3Com modem drivers - spider.sav
Post #11
Hi there: I don't use a modem…(not a dialup modem)…. using a dsl modem with a hardware firewall. the system was reformated 15april2005….however I've got all my data drives separate and some in raid configuration. Where I found the spider.sav file was just a single data disk on the root partition. I did check more and - you were right on the solitair….but I also had a file in a cab file from microsoft plus (for win98) that had a pointer to this spider.sav. I've deleted the file and the microsoft plus (for win98) from my data drive and everything seems to be fine. thanks for all your help….. you've been great! :thumbup:
Post #12
You are very welcome, hope to see you in classroom soon. Good luck and safe surfing. :)


If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI