What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

My Hijack This log - HELP!

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.99.1
Scan saved at 14:44:54, on 18/08/2005
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP1 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\NMSSvc.exe
C:\WINNT\System32\nvsvc32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\wm.exe
C:\WINNT\System32\ZipToA.exe
C:\Program Files\Sophos SWEEP for NT\SWUPDATE.EXE
C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS
C:\WINNT\Explorer.EXE
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\WINNT\System32\PROMon.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\WINNT\System32\NWTRAY.EXE
C:\Program Files\Spyware Nuker 2004\swn2.exe
C:\WINNT\System32\internat.exe
C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
C:\Program Files\winzip\WZQKPICK.EXE
C:\Documents and Settings\L233\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
res://C:\DOCUME~1\L233\LOCALS~1\Temp\se.dll/space.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
res://C:\DOCUME~1\L233\LOCALS~1\Temp\se.dll/space.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP =
about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP =
about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title =
Microsoft Internet Explorer provided by The University of Glasgow
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings,AutoConfigURL = http://wwwcache.gla.ac.uk/glasgow.pac
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
- C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7A283449-FEB0-4225-87F3-C644A7CD8AA6} -
C:\WINNT\System32\mebl.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio -
{8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [POINTER] point32.exe
O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon
initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog
Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec
Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD
Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Iomega Startup Options] C:\Program
Files\Iomega\Common\ImgStart.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program
Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [outpostupdate] C:\WINNT\System32\outpostupdate.exe
O4 - HKLM\..\Run: [Spyware Nuker] C:\Program Files\Spyware Nuker
2004\swn2.exe /h
O4 - HKLM\..\RunServices: [outpostupdate]
C:\WINNT\System32\outpostupdate.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [outpostupdate] C:\WINNT\System32\outpostupdate.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common
Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: InterCheck Monitor.LNK = C:\Program Files\Sophos
SWEEP for NT\ICMON.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program
Files\winzip\WZQKPICK.EXE
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll
O17 -
HKLM\System\CCS\Services\Tcpip\..\{1006BB35-3FD7-4ABA-923A-DAA7D65D3496}: NameServer = 130.209.4.16,130.209.4.18,130.209.16.6
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList =
ibls.gla.ac.uk,gla.ac.uk,cent.gla.ac.uk
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList =
ibls.gla.ac.uk,gla.ac.uk,cent.gla.ac.uk
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList =
ibls.gla.ac.uk,gla.ac.uk,cent.gla.ac.uk
O18 - Filter: text/html - {16CED5CA-B944-4795-9A79-B9F13AFD19A2} -
C:\WINNT\System32\mebl.dll
O18 - Filter: text/plain - {16CED5CA-B944-4795-9A79-B9F13AFD19A2} -
C:\WINNT\System32\mebl.dll
O20 - Winlogon Notify: nwprovau - C:\WINNT\SYSTEM32\nwprovau.dll
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) -
VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: IomegaAccess - Iomega Corporation -
C:\WINNT\System32\IomegaAccess.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation -
C:\WINNT\System32\NMSSvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA
Corporation - C:\WINNT\System32\nvsvc32.exe
O23 - Service: Sophos Anti-Virus Network (SweepNet) - Sophos Plc -
C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
O23 - Service: Sophos Anti-Virus (SWEEPSRV.SYS) - Sophos Plc -
C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS
O23 - Service: Sophos Anti-Virus Update (SweepUpdate) - Sophos Plc -
C:\Program Files\Sophos SWEEP for NT\SWUPDATE.EXE
O23 - Service: Novell Workstation Manager (WM) - Novell, Inc. -
C:\WINNT\System32\wm.exe
O23 - Service: ZipToA - Iomega Corporation -
C:\WINNT\System32\ZipToA.exe
Post #2
We are sorry for the delay in replying to you.

If you still require help, please Move HijackThis to Permanent Folder:
HijackThis needs to be placed into a permanent folder as it creates backups of everything fixed and you won't want these on your desktop.
  • Go to Start > My Computer > and double click on C:.
  • Now right click an open area and click New > folder and change the folder name to HJT.
  • Move HijackThis from the desktop into this new folder.
Post a fresh Hijackthis log as a reply to this thread. Before replying, open Notepad, click Format and uncheck WordWrap.

I'll receive an e-mail notification of your reply and will respond as soon as possible.

Thank you for your patience.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI