What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Spyware log help

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.99.1
Scan saved at 06:29:33 p.m., on 09/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Archivos de programa\Eset\nod32krn.exe
D:\Archivos de programa\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
D:\WINDOWS\System32\svchost.exe
D:\Archivos de programa\Webroot\Spy Sweeper\SpySweeper.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.EXE
D:\Archivos de programa\Webroot\Spy Sweeper\SpySweeperUI.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Archivos de programa\CursorXP\CursorXP.exe
D:\Archivos de programa\Webroot\Spy Sweeper\SSU.EXE
D:\Archivos de programa\Mozilla Firefox\firefox.exe
D:\Archivos de programa\Internet Download Manager\IDMan.exe
D:\Archivos de programa\Internet Explorer\iexplore.exe
D:\DOCUME~1\SHUMBU~1\CONFIG~1\Temp\Directorio temporal 1 para WGA.and.OGA.v1.5.540.0___swampy___.zip\WGA.and.OGA.v1.5.540.0___swampy___.exe
D:\DOCUME~1\SHUMBU~1\CONFIG~1\Temp\is-UMKL6.tmp\is-FUR0B.tmp
D:\Archivos de programa\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bixcdhayuqfilv.net/VhaG2RhvDihf…zPyhFChDnE.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=D:\WINDOWS\system32\userinit.exe,D:\Windows\System32\userinit.exe,
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Archivos de programa\Internet Download Manager\IDMIECC.dll
O2 - BHO: (no name) - {0362B10A-C54A-BEA9-DA4F-0A77AE5E3BFB} - D:\DOCUME~1\SHUMBU~1\DATOSD~1\SIXTHI~2\SectThat.exe (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Archivos de programa\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Archivos de programa\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: QuickSearch Search Bar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - D:\Archivos de programa\QuickSearch\QuickSearchBar1_27.dll (file missing)
O2 - BHO: (no name) - {8C17466F-51E1-EBB5-996B-51B3ED3D99B3} - D:\DOCUME~1\SHUMBU~1\DATOSD~1\SIXTHI~2\SectThat.exe (file missing)
O2 - BHO: IECatcher Class - {B930BA63-9E5A-11D3-A288-0000E80E2EDE} - D:\Archivos de programa\Mass Downloader\MDHELPER.DLL (file missing)
O2 - BHO: (no name) - {E1264331-D7F4-AF24-823C-814D86AE729F} - D:\WINDOWS\system32\lhefdlt.dll (file missing)
O3 - Toolbar: QuickSearch Search Bar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - D:\Archivos de programa\QuickSearch\QuickSearchBar1_27.dll (file missing)
O3 - Toolbar: QuickSearch Search Bar - {82315A18-6CFB-44a7-BDFD-90E36537C252} - D:\Archivos de programa\QuickSearch\QuickSearchBar1_27.dll (file missing)
O4 - HKLM\..\Run: [MessengerPlus3] "D:\Archivos de programa\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Archivos de programa\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Archivos de programa\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus C63 Series] "D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I4C1.EXE" /P23 "EPSON Stylus C63 Series" /O6 "USB001" /M "Stylus C63"
O4 - HKLM\..\Run: [EPSON Stylus C63 Series (Copiar 1)] "D:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I4C1.EXE" /P34 "EPSON Stylus C63 Series (Copiar 1)" /O6 "USB001" /M "Stylus C63"
O4 - HKLM\..\Run: [TkBellExe] "D:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunOnce: [InnoSetupRegFile.0000000001] "D:\WINDOWS\is-K8RJ5.exe" /REG
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] "D:\Archivos de programa\CursorXP\CursorXP.exe"
O4 - HKCU\..\Run: [MSMSGS] "D:\Archivos de programa\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Office.lnk = D:\Archivos de programa\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Download with &DAP - D:\ARCHIV~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - D:\ARCHIV~1\DAP\dapextie2.htm
O8 - Extra context menu item: Download All Links with IDM - D:\Archivos de programa\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - D:\Archivos de programa\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Look Up in &Encyclopedia - D:\WINDOWS\Web\ERS_ENC.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Archivos de programa\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Archivos de programa\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - D:\ARCHIV~1\DAP\DAP.EXE
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O9 - Extra button: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - D:\Archivos de programa\Free Surfer\FS20.exe (file missing)
O9 - Extra 'Tools' menuitem: Free Surfer - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - D:\Archivos de programa\Free Surfer\FS20.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - D:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O12 - Plugin for .spop: D:\Archivos de programa\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697519} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp6_aac.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\ARCHIV~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: WgaLogon - D:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - D:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - D:\Archivos de programa\Archivos comunes\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Microsoft Security Subsystem Provider (eProxy) - Unknown owner - D:\WINDOWS\ngsrv.exe" " (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Archivos de programa\Archivos comunes\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Archivos de programa\Eset\nod32krn.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Archivos de programa\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Motor de Spy Sweeper de Webroot (WebrootSpySweeperService) - Webroot Software, Inc. - D:\Archivos de programa\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Softex WinRoute Service (WinRServ) - Unknown owner - D:\Archivos de programa\Softex\Winroute\WinRServ.exe

Hi guys!
There is something wrong with my computer. I just want to get ride of the problem and I don't understand this kind of things very well. So I need some professional help. Help plsss
Post #2
Thanks for sending your information. We are sorry for the delay in responding. The volunteers here are swamped and unfortunately not all logs get answered as quickly as we'd like.

If you still need help with your problem, please run Hijack This again. Scan and copy the log, then post it here, in this topic . We do need to see a current logfile.

Please provide a description of the problem.

Please do not edit your Hijack This log. We need to see the entire logfile, with no revisions. If anything is disabled using MSCONFIG, please enable all, before scanning with Hijack This.

Please use the [external image: Posted Image] button to reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI