What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

hijackThis log file

23 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
I'm really sorry if i'm doing things wrong, i promise i follow whatever u say but this is the log file i still get:

Logfile of HijackThis v1.99.1
Scan saved at 7:49:31 PM, on 9/25/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\java\infosys.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
D:\MATLAB6p5\webserver\bin\win32\matlabserver.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\svchost.exe
D:\Setup Files\hijackthhis\HijackThis.exe

O2 - BHO: CATLEvents Object - {BB54DE33-E539-4749-BFAC-CC49617E8F2A} - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\RunOnce: [*infosys] C:\WINDOWS\java\infosys.exe rerun
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab34120.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.my-etrust.com/Support/PestScanner/pestscan.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1126193840377
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab36107.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab35645.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O17 - HKLM\System\CS1\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O17 - HKLM\System\CS2\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: infosys - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - D:\MATLAB6p5\webserver\bin\win32\matlabserver.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
Post #32
Look for this folder on your machine:

C:\!Submit

It is a folder created by Killbox to preserve a copy of the "killed" files.

If it doesn't exist, then you aren't getting the files into Killbox.

If it does exists, post all the file names of the files in that folder.

Let me know what you find out.
Post #34 last edited
Copy the text in the following quote box into Notepad:

attrib C:\WINDOWS\java\sysofni.ini > results.txt
attrib -r -s -h C:\WINDOWS\java\sysofni.ini
del C:\WINDOWS\java\sysofni.ini >> results.txt
attrib C:\WINDOWS\java\sysofni.bak2 >> results.txt
attrib -r -s -h C:\WINDOWS\java\sysofni.bak2
del C:\WINDOWS\java\sysofni.bak2 >> results.txt
attrib C:\WINDOWS\java\infosys.exe >> results.txt
attrib -r -s -h C:\WINDOWS\java\infosys.exe
del C:\WINDOWS\java\infosys.exe >> results.txt
attrib C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat >> results.txt
attrib -r -s -h C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat
del C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat >> results.txt

Save it to your desktop as df.bat.

Close Notepad.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

O2 - BHO: CATLEvents Object - {BB54DE33-E539-4749-BFAC-CC49617E8F2A} - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat

O4 - HKLM\..\RunOnce: [*infosys] C:\WINDOWS\java\infosys.exe rerun

O20 - Winlogon Notify: infosys - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat

Then click "Fix checked".

Close Hijack This!

Push these three keys at the same time:



The task manager appears on the screen.

Click on the Processes tab, then on Image name to sort them alphabetically.

In the list of processes find:

infosys.exe

on it, and choose End process.

Close the task manager.

Now, the df.bat file on the desktop.

Reboot.

After the reboot, open results.txt on the desktop with Notepad, paste it's contents into your next post, along with a new Hijack This! log file.
Post #35
i'm sorry but i swear that there was infosys.exe in task manager
only IEXPLORE.EXE.
There was a WINLOGON.EXE though.
results.txt:
SH C:\WINDOWS\java\sysofni.ini
SH C:\WINDOWS\java\sysofni.bak2
C:\WINDOWS\java\infosys.exe
C:\WINDOWS\java\infosys.exe
SH C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat
C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat

Logfile of HijackThis v1.99.1
Scan saved at 3:04:07 PM, on 9/26/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
D:\MATLAB6p5\webserver\bin\win32\matlabserver.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\java\infosys.exe
C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
D:\Setup Files\hijackthhis\HijackThis.exe

O2 - BHO: CATLEvents Object - {BB54DE33-E539-4749-BFAC-CC49617E8F2A} - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\RunOnce: [*infosys] C:\WINDOWS\java\infosys.exe rerun
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab34120.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.my-etrust.com/Support/PestScanner/pestscan.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1126193840377
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab36107.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab35645.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O17 - HKLM\System\CS1\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O17 - HKLM\System\CS2\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: infosys - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - D:\MATLAB6p5\webserver\bin\win32\matlabserver.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
Post #38
That tell's me that you're not getting all the file names copied into the clipboard for Killbox.

That file is a log of what Killbox has "killed".

If you go back to the last time I instructed you to use Killbox, it should have these files in the log:

C:\WINDOWS\java\sysofni.ini
C:\WINDOWS\java\sysofni.bak2
C:\WINDOWS\java\infosys.exe
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf

Somehow, you only got the first one copied into the clipboard.

Try this:

C:\WINDOWS\java\sysofni.ini
C:\WINDOWS\java\sysofni.bak2
C:\WINDOWS\java\infosys.exe
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf


Try to "copy" those into the clipboard. Then open a new text document with Notepad, and see if you can "paste" all of those in there.

When you can do that, go back to the last post you were told to use Killbox in, and re-do that fix.
:)
Post #44
NOTE: sometimes when i try to shutdown my comp i get an error message saying::

infosys.exe – .DLL application failed to initialize

also contents of the kb folder are:

C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
File Was Deleted
C:\WINDOWS\java\sysofni.bak2
File Was Deleted
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
File Was Deleted
C:\WINDOWS\java\infosys.exe
C:\WINDOWS\java\infosys.exe
This File could not be Deleted
C:\WINDOWS\java\infosys.exe
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
This File could not be Deleted
File Was Deleted
This File could not be Deleted
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
File Was Deleted
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\Documents and Settings\LAN\Local Settings\Temp\sysofni.dat
Delete on Reboot
C:\WINDOWS\Prefetch\INFOSYS.EXE-26A61CD2.pf
Delete on Reboot
C:\WINDOWS\java\infosys.exe
Delete on Reboot
C:\WINDOWS\java\sysofni.bak2
Delete on Reboot
C:\WINDOWS\java\sysofni.ini
Delete on Reboot


Logfile of HijackThis v1.99.1
Scan saved at 6:21:32 PM, on 9/28/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
D:\MATLAB6p5\webserver\bin\win32\matlabserver.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe
C:\WINDOWS\java\infosys.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Setup Files\hijackthhis\HijackThis.exe

O2 - BHO: CATLEvents Object - {BB54DE33-E539-4749-BFAC-CC49617E8F2A} - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar\01.01.1629.0\en-us\msntb.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\RunOnce: [*infosys] C:\WINDOWS\java\infosys.exe rerun
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab34120.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.my-etrust.com/Support/PestScanner/pestscan.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1126193840377
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab36107.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab35645.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O17 - HKLM\System\CS1\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O17 - HKLM\System\CS2\Services\Tcpip\..\{296B263E-6922-4B5B-A995-B6D63380B7D0}: NameServer = 202.134.160.8,202.134.160.7
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: infosys - C:\DOCUME~1\LAN\LOCALS~1\Temp\sysofni.dat
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - D:\MATLAB6p5\webserver\bin\win32\matlabserver.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
Post #45
Monty Python, "And now for something completely different…."
:weee:

Download/install this:

MoveOnBoot

Run Hijack This!

Click the "Open the Misc Tools" section Button.

Click the "Open Process Manager" Button.

Click the floppy disk icon (upper right) to "Save list to file".

Copy and paste the contents of this list into your reply.
:)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI