What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijack log

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I need help, my sygate firewall keeps warning me about applications getting hijacked, pretty much anything like my mail, games, firefox, i also have programs like svhost, wmiprvse.exe, and nt kernal giving mr warning of attempts to connect through them.

Logfile of HijackThis v1.99.1
Scan saved at 7:15:23 PM, on 6/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\nvsvc32.exe
c:\PROGRA~1\Sony\Station\Infantry\Infantry.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\alex\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hometab.bellsouth.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hometab.bellsouth.net/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
Post #2 last edited
Hello Alex, I see nothing in the log, I am not familiar with Sygate but are you sure it is just not set to warn you anytime a program tries to access the internet? You should be able to set it to allow normal necessary programs to access the internet without bothering you and to notify you if something that does not have permission tries to set in.
For instance wmiprvse.exe is http://www.liutilities.com/products/wintas…brary/wmiprvse/ and it is normal for it to contact the internet.

i also have programs like svhost, <<<

I am going to assume you have misspelled this and it is actually svchost.exe which will open several applications when different programs need internet access or to run, see this: http://support.microsoft.com/?kbid=314056 This one: nt kernal is incomplete, I will need the exact message you receive. I could be wrong, but this may just be normal operation. You must write down the messages exactly as you get them and make sure to spell them exactly.
Here is some information about the Sygate firewall and how to set it up:
http://www.pcplus.co.uk/tutorials/default….subsectionid=73 Take a look at some of these links for help in configuring and understanding the reports you will receive from your Sygate firewall.
http://www.google.com/search?hl=en&lr;=&biw;…all&btnG;=Search

What about your AVG antivirus program? When you update and run it what does it have to say?

Your HJT log, you are running Selective Startup in your System Configuration Utility (msconfig) and I have no way of knowing if something bad is turned off. Before you post a new log, please Enable All then scan for and make the log then you can return to Selective Startup if you wish.

If you want to run a check to see if anything is hiding then do this:

Ewido trojan scanner: http://www.ewido.net/en/download/
Please download, install, update and scan your system with the free version of Ewido trojan scanner:
  1. When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
  2. When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  3. From the main ewido screen, click on update in the left menu, then click the Start update button.
  4. After the update finishes (the status bar at the bottom will display "Update successful"), click on the Scanner button in the left menu, then click on the Start button. This scan can take quite a while to run, so time to go get a drink and a snack….
  5. If ewido finds anything, it will pop up a notification. You can select "clean" and check the boxes "Perform action with all infections" and "Create encrypted backup" before clicking on OK.
  6. When the scan finishes, click on "Save Report". This will create a text file. Please then paste the contents of the text file to this thread.

    7. Post a new HJT log along with the Ewido scan results in this same thread. Make sure everything is enabled in MSCONFIG. Add your comments and any information you think will help.

    Thanks…pskelley
    TomCoyote forum
    Slyware Warrior
Post #3
Clean log, no response in ten days.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI