What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

hijack this log

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Meathpark,


Windows creates a desktop.ini in any folder that you have viewed in the thumbnail mode. Make sure you don't have the thumbnail view enabled in either of the desktop folders, and then you can delete the file. It looks like you can safely delete it from the startup folder, leave the rest alone.

Here is further reading,
http://www.experts-exchange.com/Databases/Q_20833409.html

If you follow along with the above, be cautious,
kernel.dll <–Virus
kernel32.dll <– Legit Windows File

Post back with a new log and let me know how your doing.

Ken
Post #17
Hi, I read the forum threads and deleted my folder.htt (360) and desktop.ini (373) files. I did NOT have a kernel.dll and DO have my kernel32.dll. I suspect I may have deleted the kernel.dll during a previous (incomplete?) virus scan& fix either with spy sweeper or Panda. I have not yet rebooted. I hope everything will be ok as I got warnings about deleting the desktop.ini files since they were system or read only files. Here is my log after the deletions but before rebooting. I'll send another log after rebooting if there is any change. meathpark (As to your previous post, the desktop.ini file in startup was a hidden file, not a shortcut)
Post #18
OOOOPS
Forgot the log.

meathpark

Logfile of HijackThis v1.99.1
Scan saved at 2:41:10 AM, on 8/3/05
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\WINDOWS\RunDLL.exe
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_BAND_SEARCHBAR_HTML
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = www.inet2000.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://statcounter.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://statcounter.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.shareware.us/srchasst.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = INET2000 Internet Explorer
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\COPERN~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MonsterHosting.ca Toolbar - {5A098C30-7AF2-48E9-BD7C-4E980D8D1E11} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\MONSTERHOSTING.CA.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Search Using Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.dll/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: Use webcow on this &Selection - C:\WINDOWS\DESKTOP\ESSENTIAL EBIZ WEB TOOLS\wcie.iemenu2.htm
O8 - Extra context menu item: &Use webcow on this Page - C:\WINDOWS\DESKTOP\ESSENTIAL EBIZ WEB TOOLS\wcie.iemenu.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {5A098C30-7AF2-48E9-BD7C-4E980D8D1E11} (MonsterHosting.ca Toolbar) - http://www.monsterhosting.ca/toolbar/insta…rhosting.ca.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by105fd.bay105.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
Post #19
meathpark,

Your log looks clean :D Here are some tips and free tools to install to help keep the bad guys out in the future.



Now that your clean, we need to erase all possible older infected files that may still be lurking on your system.
clean out your TEMP FILES

* This procedure should be run from SAFEMODE for better results.

To Enter SAFEMODE

* Go to START/ SHUT OF YOUR COMPUTER/ RESTART
* As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly, this will bring up a menu.
* Use the UP AND DOWN ARROW KEYS to scroll up to SAFEMODE
* Then press the ENTER KEY ON YOUR KEYBOARD

Now, while in SAFEMODE,

* click on START/ RUN , and type %temp% and press the ok button.

This will open up the temp directory that your machine uses. GO TO EDIT/ SELECT ALL and delete all the contents of that folder.
* Do this for each user of your computer.
* Do this same process for %windir%\temp.

NOW RE-BOOT NORMALLY

DELETE TEMPORARY INTERNET FILES

* Open INTERNET EXPLORER
* Click on the TOOLS MENU
* Then INTERNET OPTIONS
* At the GENERAL TAB, (which should be the first tab you are currently on),
* click on the DELETE FILES BUTTON and put a checkmark in DELETE ALL OFFLINE CONTENT.
* Then press the OK BUTTON . This may take quite a while, so do not be alarmed with how long it takes.
* When it is done, your Temporary Internet Files will now be deleted.

* Make sure that your ANTI-VIRUS SOFTWARE is up to date and run a full scan at least once aweek.
* If you want to use a free program, try this one –> http://free.grisoft.com/doc/1

* Run SPYBOT SEARCH AND DESTROY/ CHECK FOR UPDATES/ IMMUNIZE and run a full system scan on a regular basis.

* Run AD-AWARE SE PERSONAL/ CHECK FOR UPDATES and run a FULL SYSTEM SCAN on a regular basis.

* Follow the links at the bottom of my post and download and run SPYWARE BLASTER, check for updates and enalble all protection.

* Also install SPYWARE GUARD.
These two programs won't scan your system, but will sit in the background blocking most of the garbage from installing in the first place.

* WINDOWS UPDATES -
Go to Tools > Windows Updates and make sure you keep your operating system patched with the latest updates from Microsoft.

* Consider surfing the web with the FIREFOX BROWSER it is much more secure than Internet Explorer.
http://www.mozilla.org/products/firefox/

* Run CCleaner it does a great job of keeping your system clean of all the garbage that is not needed that you accumulate over time.
http://www.ccleaner.com/

I will keep this thread open for a few days in case you have any other questions, been a pleasure helping you, thanks for using Tom Coyote

Ken :D
Post #20
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI