What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Plat's HijackThis Log

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I would appreciate is my log can be checked as I would like to know if there are any dangerous programs running on my computer.

Logfile of HijackThis v1.99.1
Scan saved at 8:57:46 AM, on 23/08/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
C:\WINNT\system32\eelogsvc.exe
C:\WINNT\system32\eelssrv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\InputDevLockSrv.exe
c:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\PeaCY\PeacyHard\pcstart.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\snmp.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\rundll32.exe
c:\program files\peacy\PeaCyX.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINNT\System32\igfxtray.exe
C:\WINNT\System32\hkcmd.exe
C:\winnt\multicast\DisableSuspend.exe
C:\Program Files\getMcReg\getmcreg.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\PROGRA~1\SECUDE\OFFICE~1\cdsetup.exe
C:\PROGRA~1\SECUDE\OFFICE~1\psesvc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Entrust\ESP\eecwatch.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINNT\system32\internat.exe
C:\program files\common files\entrust\esp\eesystry.exe
C:\WINNT\system32\eelssrv.exe
C:\WINNT\System32\SCardSvr.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\WINNT\TEMP\DFF428.EXE
c:\peacy.sys\config\0\pmiputpackagestatus.exe
C:\Program Files\Adobe\Reader 6.0\Reader\AcroRd32.exe
C:\WINNT\system32\WISPTIS.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cl.au.bosch.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Peacy
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://bcs/proxy.pac
F2 - REG:system.ini: UserInit=C:\WINNT\SYSTEM32\USERINIT.EXE
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Reader 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [PeaCy] kix32 c:\peacy.sys\config\0\pclogin.scr
O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [DisableSuspend] c:\winnt\multicast\DisableSuspend c:\peacy.sys\multicast
O4 - HKLM\..\Run: [GetMcReg] C:\Program Files\getMcReg\getmcreg.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [CDSetup] c:\PROGRA~1\SECUDE\OFFICE~1\cdsetup.exe
O4 - HKLM\..\Run: [PSEService] c:\PROGRA~1\SECUDE\OFFICE~1\psesvc.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [espwatchdog] C:\Program Files\Common Files\Entrust\ESP\eecwatch.exe
O4 - HKLM\..\Run: [AeXAgentLogon] "C:\Program Files\Altiris\Altiris Agent\AeXAgentActivate.exe" /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [eesystry.exe] c:\program files\common files\entrust\esp\eesystry.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://c:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra button: Support IE - {1937BF31-B387-4237-8E43-DE41CD1F09FD} - http://www.intranet.bosch.com/ci/os/osc1/1/wbrowser (file missing) (HKCU)
O9 - Extra button: Peacy - {8119210F-0B06-41F0-9619-AA85163892EF} - http://www.ilab.bosch.de (file missing) (HKCU)
O15 - Trusted Zone: http://www.apc.com
O15 - Trusted Zone: http://full.chemwatch.net
O15 - Trusted Zone: http://www.cisco.com
O15 - Trusted Zone: http://mail.epr.com.au
O15 - Trusted Zone: http://www.epr.com.au
O15 - Trusted Zone: http://www.globalcc.com.au
O15 - Trusted Zone: http://www.seek.com.au
O15 - Trusted Zone: http://www.globalcc.com.au"
O15 - Trusted Zone: http://www.cwnp.com
O15 - Trusted Zone: http://www.datacentreuniversity.com
O15 - Trusted Zone: http://packeteer.enlight.net
O15 - Trusted Zone: http://*.globalknowledge.com
O15 - Trusted Zone: http://www.motorola.com
O15 - Trusted Zone: http://www.packeteer.com
O15 - Trusted Zone: http://www.surveymonkey.com
O15 - Trusted Zone: http://www.tomcoyote.org
O15 - Trusted Zone: http://www.webtorials.com
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://mail.epr.com.au/msrdp.cab
O16 - DPF: {D018CE2C-B7BE-458D-BE1B-E23919D96FBF} (CISetting Object) - http://www.intranet.bosch.com/trustcenter/…on/SetParam.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = cl.au.bosch.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = cl.au.bosch.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = cl.au.bosch.com
O20 - Winlogon Notify: BNCP - C:\WINNT\system32\bncp.dll
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: PCINS - C:\WINNT\system32\pcins.dll
O23 - Service: Altiris Agent (AeXNSClient) - Altiris, Inc. - C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
O23 - Service: AutoExNT - Unknown owner - C:\WINNT\system32\AutoExNT.Exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Entrust Entelligence Logging Service (eelogsvc) - Entrust® - C:\WINNT\system32\eelogsvc.exe
O23 - Service: Entrust Entelligence Login Service (EELSService) - Entrust® - C:\WINNT\system32\eelssrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Input Device Lock Service (InputDeviceLockSrv) - ILAB - C:\WINNT\InputDevLockSrv.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: PcyHard - Unknown owner - C:\Program Files\PeaCY\PeacyHard\pcstart.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
Post #2
Thanks for sending your information. We are sorry for the delay in responding. The volunteers here are swamped and unfortunately not all logs get answered as quickly as we'd like.

If you still need help with your problem, please run Hijack This again. Scan and copy the log, then post it here, in this topic . We do need to see a current logfile.

Please provide a description of the problem.

Please do not edit your Hijack This log. We need to see the entire logfile, with no revisions. If anything is disabled using MSCONFIG, please enable all, before scanning with Hijack This.

Please use the [external image: Posted Image] button to reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI