What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Analysis Requested For Hijack This Log

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hello! I would very much appreciate an analysis of the following Hijack This log. I've run Spybot SD and it's found spyware, but I still have problems with pop-ups and also a menu bar that I can't get rid of. Any assistance would be greatly appreciated! Thank you.

Logfile of HijackThis v1.97.7
Scan saved at 7:56:48 AM, on 4/1/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\nslsvice.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\Program Files\VMware\VMware Workstation\Programs\vmware-authd.exe
C:\WINDOWS\System32\vmnetdhcp.exe
C:\WINDOWS\SYSTEM32\vmnat.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\System32\mspmspsv.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\tp4mon.exe
C:\CFGSAFE\AUTOCHK.EXE
C:\WINDOWS\loadqm.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\AceSoapBold\GRIDCHIN.exe
C:\Program Files\Window Active\winactive.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\WINDOWS\System32\internat.exe
C:\Downloads\jabber\jajc\jajc.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Lotus\Notes\NLNOTES.EXE
C:\Lotus\Notes\namgr.EXE
C:\Lotus\Notes\nWEB.EXE
C:\Lotus\Notes\nhldaemn.EXE
C:\Program Files\hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://allaboutsearching.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://allaboutsearching.com/searchbar.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://allaboutsearching.com/passthrough/i…://www.msn.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://allaboutsearching.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://popnav.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://allaboutsearching.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://allaboutsearching.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://allaboutsearching.com/searchbar.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=httpproxy2.nettricity.com:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = dev14.datahouse.com, 172.20.52.5, 172.18.9.131, 172.20.52.6, 172.17.1.100;
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50032
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - C:\PROGRA~1\Toolbar\toolbar.dll
O1 - Hosts: 172.18.2.15 datadev2-1
O1 - Hosts: 172.18.1.11 datahouse
O1 - Hosts: 172.18.1.24 datahub-31
O1 - Hosts: 172.18.2.13 domino5
O1 - Hosts: 12.18.128.34 idc_smtp1
O1 - Hosts: 172.18.9.80 datadev-14
O1 - Hosts: 172.18.9.54 datadev-17
O1 - Hosts: 172.18.9.130 dcis_dev1
O1 - Hosts: 172.18.9.138 datadev-9.datahub.com
O1 - Hosts: 172.20.2.8 talisker
O1 - Hosts: 172.18.9.131 yoshi
O1 - Hosts: 172.18.9.182 domino1
O1 - Hosts: 172.18.9.186 data_rd-3
O1 - Hosts: 172.18.9.148 datadev-25 oly2
O1 - Hosts: 172.18.9.212 repository
O1 - Hosts: 172.18.9.212 domino1
O1 - Hosts: 172.18.9.196 datadev-15
O1 - Hosts: 172.18.9.68 oly1
O1 - Hosts: 172.18.9.186 olydom
O1 - Hosts: 172.18.9.35 rodtest_1
O1 - Hosts: 155.252.67.3 pwcphnotes
O1 - Hosts: 172.18.1.32 dataweb-1
O1 - Hosts: 172.18.1.134 datahub5-1
O1 - Hosts: 172.18.9.34 fc02
O1 - Hosts: 172.18.9.9 dmnoma01
O1 - Hosts: 172.18.9.131 yoshi
O1 - Hosts: 172.18.9.53 olympia1 perc01 olyDOM
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Search Toolbar - {339BB23F-A864-48C0-A59F-29EA915965EC} - C:\PROGRA~1\Toolbar\toolbar.dll
O3 - Toolbar: Okay Idol - {82B36BAD-B98C-B140-BE25-385D443C3EAB} - C:\PROGRA~1\EXITLO~1\boob data.dll
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ConfigSafe] C:\CFGSAFE\AUTOCHK.EXE
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MSVersion] C:\WINDOWS\System32\internetfeatures.exe
O4 - HKLM\..\Run: [iefeatures] C:\WINDOWS\System32\iefeatures.exe
O4 - HKLM\..\Run: [userref] C:\PROGRA~1\AceSoapBold\GRIDCHIN.exe
O4 - HKLM\..\Run: [winactive] C:\Program Files\Window Active\winactive.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [JAJC] C:\Downloads\jabber\jajc\jajc.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O9 - Extra button: AOL Instant Messenger (SM) (HKLM)
O9 - Extra button: Real.com (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Sametime Meeting Room Client ST20 - http://econference.infoblade.com/sametime/…gRoomClient.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://172.18.9.226/qp2.cab
O16 - DPF: {0B9C9C7D-ED81-4594-AFCB-FC5588125382} (JNILoader Control) - http://econference.infoblade.com/sametime/…STJNILoader.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://activex.microsoft.com/activex/contr…media/Swdir.cab
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - http://mail.ameronhawaii.com/iNotes.cab
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - http://172.18.9.131/iNotes6.cab
O16 - DPF: {A4639D2F-774E-11D3-A490-00C04F6843FB} (IEAnimBehaviorFactory Class) - http://download.microsoft.com/download/viz…N-US/msorun.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {BB47CA33-8B4D-11D0-9511-00C04FD9152D} (ExteriorSurround Object) - http://carpoint.msn.com/Components/Ocx/Exterior/Outside.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {D9DB2AD8-C33F-4238-B990-9852EBCA4693} (PAXCOM.officeXP) - http://172.18.9.5/web_local/CABs/PAXCOM.CAB
O16 - DPF: {DED22F57-FEE2-11D0-953B-00C04FD9152D} (CarPoint Auto-Pricer Control) - http://carpoint.msn.com/components/ocx/aut…/autopricer.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - http://datahouse.webex.com/client/latest/webex/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{663F68A3-A84B-463C-8918-AC76276D2B07}: Domain = datahouse.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{663F68A3-A84B-463C-8918-AC76276D2B07}: NameServer = 172.18.1.2,172.18.1.6
Post #2
Click here to download Ad-Aware and install. Before scanning click on "check for updates now" to make sure you have the latest reference file. Then click the gear wheel at the top and check these options:

General> activate these: "Automatically save log-file" and "Automatically quarantine objects prior to removal"

Scanning > activate these: "Scan within archives", "Scan active processes", "Scan registry", "Deep scan registry", "Scan my IE Favorites for banned sites" and "Scan my Hosts file"

Tweaks > Scanning Engine> activate this: "Unload recognized processes during scanning."

Tweaks > Cleaning Engine: activate these: "Automatically try to unregister objects prior to deletion" and "Let Windows remove files in use after reboot."

Click "Proceed" to save your settings, then click "Start", make sure "Activate in-depth scan" is ticked green then scan your system. When the scan is finished, the screen will tell you if anything has been found, click "Next". The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".

Reboot when done, rescan with HJT and post a new log here so that any remnants can be removed manually.
Post #3
Thank you for your quick response. I downloaded adware 6 and configured it according to your specifications. I ran adware and it looks to have cleaned out all the spyware that was on my machine. However, I'm posting the Hijack This log that I ran after adware for your analysis to verify that there are no other files that need to be removed. Thanks again for all your help!

Logfile of HijackThis v1.97.7
Scan saved at 3:22:33 PM, on 4/1/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\nslsvice.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\Program Files\VMware\VMware Workstation\Programs\vmware-authd.exe
C:\WINDOWS\System32\vmnetdhcp.exe
C:\WINDOWS\SYSTEM32\vmnat.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\System32\mspmspsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\WINDOWS\System32\tp4mon.exe
C:\CFGSAFE\AUTOCHK.EXE
C:\WINDOWS\loadqm.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\internat.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Lotus\Notes\NLNOTES.EXE
C:\Lotus\Notes\namgr.EXE
C:\Lotus\Notes\nWEB.EXE
C:\Lotus\Notes\nhldaemn.EXE
C:\Program Files\hijack\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://popnav.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=httpproxy2.nettricity.com:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = dev14.datahouse.com, 172.20.52.5, 172.18.9.131, 172.20.52.6, 172.17.1.100;
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
O1 - Hosts: 172.18.2.15 datadev2-1
O1 - Hosts: 172.18.1.11 datahouse
O1 - Hosts: 172.18.1.24 datahub-31
O1 - Hosts: 172.18.2.13 domino5
O1 - Hosts: 12.18.128.34 idc_smtp1
O1 - Hosts: 172.18.9.80 datadev-14
O1 - Hosts: 172.18.9.54 datadev-17
O1 - Hosts: 172.18.9.130 dcis_dev1
O1 - Hosts: 172.18.9.138 datadev-9.datahub.com
O1 - Hosts: 172.20.2.8 talisker
O1 - Hosts: 172.18.9.131 yoshi
O1 - Hosts: 172.18.9.182 domino1
O1 - Hosts: 172.18.9.186 data_rd-3
O1 - Hosts: 172.18.9.148 datadev-25 oly2
O1 - Hosts: 172.18.9.212 repository
O1 - Hosts: 172.18.9.212 domino1
O1 - Hosts: 172.18.9.196 datadev-15
O1 - Hosts: 172.18.9.68 oly1
O1 - Hosts: 172.18.9.186 olydom
O1 - Hosts: 172.18.9.35 rodtest_1
O1 - Hosts: 155.252.67.3 pwcphnotes
O1 - Hosts: 172.18.1.32 dataweb-1
O1 - Hosts: 172.18.1.134 datahub5-1
O1 - Hosts: 172.18.9.34 fc02
O1 - Hosts: 172.18.9.9 dmnoma01
O1 - Hosts: 172.18.9.131 yoshi
O1 - Hosts: 172.18.9.53 olympia1 perc01 olyDOM
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ConfigSafe] C:\CFGSAFE\AUTOCHK.EXE
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MSVersion] C:\WINDOWS\System32\internetfeatures.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O9 - Extra button: AOL Instant Messenger (SM) (HKLM)
O9 - Extra button: Real.com (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Sametime Meeting Room Client ST20 - http://econference.infoblade.com/sametime/…gRoomClient.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://172.18.9.226/qp2.cab
O16 - DPF: {0B9C9C7D-ED81-4594-AFCB-FC5588125382} (JNILoader Control) - http://econference.infoblade.com/sametime/…STJNILoader.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://activex.microsoft.com/activex/contr…media/Swdir.cab
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - http://mail.ameronhawaii.com/iNotes.cab
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - http://172.18.9.131/iNotes6.cab
O16 - DPF: {A4639D2F-774E-11D3-A490-00C04F6843FB} (IEAnimBehaviorFactory Class) - http://download.microsoft.com/download/viz…N-US/msorun.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {BB47CA33-8B4D-11D0-9511-00C04FD9152D} (ExteriorSurround Object) - http://carpoint.msn.com/Components/Ocx/Exterior/Outside.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {D9DB2AD8-C33F-4238-B990-9852EBCA4693} (PAXCOM.officeXP) - http://172.18.9.5/web_local/CABs/PAXCOM.CAB
O16 - DPF: {DED22F57-FEE2-11D0-953B-00C04FD9152D} (CarPoint Auto-Pricer Control) - http://carpoint.msn.com/components/ocx/aut…/autopricer.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - http://datahouse.webex.com/client/latest/webex/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{663F68A3-A84B-463C-8918-AC76276D2B07}: Domain = datahouse.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{663F68A3-A84B-463C-8918-AC76276D2B07}: NameServer = 172.18.1.2,172.18.1.6
Post #4
Just a little bit more to do. Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://popnav.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
O4 - HKLM\..\Run: [MSVersion] C:\WINDOWS\System32\internetfeatures.exe

Click here, for instructions on how to enable hidden files and folders to be visible. After enabling, reboot into safe mode by tapping F8 after the BIOS has loaded, find and delete the following:

C:\WINDOWS\System32\internetfeatures.exe

Reboot back into normal mode. Click here to make sure that you have the latest patches for Windows. It's very important to keep your system up to date to avoid unnecessary security risks. Rescan with HJT and post a new log here for a final check over.
Post #5
Hello! Thank you again for all your help. Here is the Hijack This log. Your feedback would be greatly appreciated. Thanks again for your assistance!

- Rod

Logfile of HijackThis v1.97.7
Scan saved at 12:01:11 PM, on 4/5/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\nslsvice.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\NavNT\defwatch.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\Program Files\VMware\VMware Workstation\Programs\vmware-authd.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\vmnetdhcp.exe
C:\WINDOWS\SYSTEM32\vmnat.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\System32\mspmspsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\tp4mon.exe
C:\CFGSAFE\AUTOCHK.EXE
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\internat.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=httpproxy2.nettricity.com:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = dev14.datahouse.com, 172.20.52.5, 172.18.9.131, 172.20.52.6, 172.17.1.100;
O1 - Hosts: 172.18.2.15 datadev2-1
O1 - Hosts: 172.18.1.11 datahouse
O1 - Hosts: 172.18.1.24 datahub-31
O1 - Hosts: 172.18.2.13 domino5
O1 - Hosts: 12.18.128.34 idc_smtp1
O1 - Hosts: 172.18.9.80 datadev-14
O1 - Hosts: 172.18.9.54 datadev-17
O1 - Hosts: 172.18.9.130 dcis_dev1
O1 - Hosts: 172.18.9.138 datadev-9.datahub.com
O1 - Hosts: 172.20.2.8 talisker
O1 - Hosts: 172.18.9.131 yoshi
O1 - Hosts: 172.18.9.182 domino1
O1 - Hosts: 172.18.9.186 data_rd-3
O1 - Hosts: 172.18.9.148 datadev-25 oly2
O1 - Hosts: 172.18.9.212 repository
O1 - Hosts: 172.18.9.212 domino1
O1 - Hosts: 172.18.9.196 datadev-15
O1 - Hosts: 172.18.9.68 oly1
O1 - Hosts: 172.18.9.186 olydom
O1 - Hosts: 172.18.9.35 rodtest_1
O1 - Hosts: 155.252.67.3 pwcphnotes
O1 - Hosts: 172.18.1.32 dataweb-1
O1 - Hosts: 172.18.1.134 datahub5-1
O1 - Hosts: 172.18.9.34 fc02
O1 - Hosts: 172.18.9.9 dmnoma01
O1 - Hosts: 172.18.9.131 yoshi
O1 - Hosts: 172.18.9.53 olympia1 perc01 olyDOM
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ConfigSafe] C:\CFGSAFE\AUTOCHK.EXE
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O9 - Extra button: AOL Instant Messenger (SM) (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: Sametime Meeting Room Client ST20 - http://econference.infoblade.com/sametime/…gRoomClient.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://172.18.9.226/qp2.cab
O16 - DPF: {0B9C9C7D-ED81-4594-AFCB-FC5588125382} (JNILoader Control) - http://econference.infoblade.com/sametime/…STJNILoader.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://activex.microsoft.com/activex/contr…media/Swdir.cab
O16 - DPF: {1E2941E3-8E63-11D4-9D5A-00902742D6E0} (iNotes Class) - http://mail.ameronhawaii.com/iNotes.cab
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - http://172.18.9.131/iNotes6.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…8082.4822337963
O16 - DPF: {A4639D2F-774E-11D3-A490-00C04F6843FB} (IEAnimBehaviorFactory Class) - http://download.microsoft.com/download/viz…N-US/msorun.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/…tiveXPlugin.cab
O16 - DPF: {BB47CA33-8B4D-11D0-9511-00C04FD9152D} (ExteriorSurround Object) - http://carpoint.msn.com/Components/Ocx/Exterior/Outside.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {D9DB2AD8-C33F-4238-B990-9852EBCA4693} (PAXCOM.officeXP) - http://172.18.9.5/web_local/CABs/PAXCOM.CAB
O16 - DPF: {DED22F57-FEE2-11D0-953B-00C04FD9152D} (CarPoint Auto-Pricer Control) - http://carpoint.msn.com/components/ocx/aut…/autopricer.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - http://datahouse.webex.com/client/latest/webex/ieatgpc.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{663F68A3-A84B-463C-8918-AC76276D2B07}: Domain = datahouse.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{663F68A3-A84B-463C-8918-AC76276D2B07}: NameServer = 172.18.1.2,172.18.1.6
Post #8
You're welcome - glad to help :D

As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI