What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Downloaded HiJackThis, but not sure on next step

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Is there a file with name sysos.exe in the C:\Windows\System32. Everytime I start my computer, it always informs that there is no sysos.exe in that folder? Also, whenever I move video files from one drive to another, the system crashes. The only video player I can use is VLC Media Player, I used to use Creative Media Player but that doesn't work anymore. Please let me know which ones from the log file I can erase. I appreciate your help. Thanks! :D

Regards,
Joey

Here's what the log file says

"Logfile of HijackThis v1.99.1
Scan saved at 3:41:28, on 1/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2

(6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007

\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile

Device

Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTSvcCDA.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2

\PcCtlCom.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~2

\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2

\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~2

\tmproxy.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\PROGRA~1\TRENDM~1\INTERN~2

\PcScnSrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2

\PccGuide.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Java\jre1.5.0_05

\bin\jusched.exe
C:\Program Files\mobile

PhoneTools\WatchDog.exe
C:\Program

Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Java\jre1.5.0_05

\bin\jucheck.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lavasoft\Ad-Aware 2007

\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Ahead\NEROPH~2

\data\Xtras\mssysmgr.exe
C:\Program Files\Trend Micro\Internet Security

2007\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Spybot - Search &

Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 5.0

\Distillr\AcroTray.exe
C:\Program Files\MOTU\FireWire

Audio\MFWAKeys.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Creative\MediaSource5

\CtDetctu.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Common

Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Microsoft

Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program

Files\BitComet\tools\CometBrowser.exe
C:\Program Files\Creative\MediaSource5

\CTCMSu.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\Program Files\Spybot - Search &

Destroy\SpybotSD.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Internet

Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Allok Video to MP4

Converter\unins000.exe
C:\DOCUME~1\JOEYCH~1\LOCALS~1

\Temp\_iu14D2N.tmp
C:\Documents and Settings\Joey

Chang\Desktop\HijackThis.exe

F2 - REG:system.ini: Shell=Explorer.exe

C:\WINDOWS\system32\sysos.exe
O3 - Toolbar: &Google - {2318C2B1-4965-11d4

-9B18-009027A5CD4F} - c:\program

files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NeroFilterCheck]

C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program

Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched]

C:\Program Files\Java\jre1.5.0_05

\bin\jusched.exe
O4 - HKLM\..\Run: [WatchDog] C:\Program

Files\mobile PhoneTools\WatchDog.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program

Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IpWins] C:\Program

Files\Ipwindows\ipwins.exe
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program

Files\Trend Micro\Internet Security 2007

\pccguide.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program

Files\Common

Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program

Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program

Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AAWTray] C:\Program

Files\Lavasoft\Ad-Aware 2007\AAWTray.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite]

"C:\Program Files\Sony Ericsson\Mobile2

\Application Launcher\Application Launcher.exe"

/startoptions
O4 - HKCU\..\Run: [ctfmon.exe]

C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media

Manager] C:\PROGRA~1\Ahead\NEROPH~2

\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [OE] "C:\Program Files\Trend

Micro\Internet Security 2007

\TMAS_OE\TMAS_OEMon.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer]

C:\Program Files\Spybot - Search &

Destroy\TeaTimer.exe
O4 - Global Startup: Acrobat Assistant.lnk =

C:\Program Files\Adobe\Acrobat 5.0

\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk =

C:\Program Files\Common

Files\Adobe\Calibration\Adobe Gamma

Loader.exe
O4 - Global Startup: Adobe Reader Speed

Launch.lnk = C:\Program Files\Adobe\Acrobat

7.0\Reader\reader_sl.exe
O4 - Global Startup: MFWAKeys.lnk =

C:\Program Files\MOTU\FireWire

Audio\MFWAKeys.exe
O4 - Global Startup: Microsoft Office OneNote

2003 Quick Launch.lnk = C:\Program

Files\Microsoft Office\OFFICE11

\ONENOTEM.EXE
O4 - Global Startup: MOTU Pedal Handler.lnk = ?
O8 - Extra context menu item: &D&ownload &with

BitComet - res://C:\Program

Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all

video with BitComet - res://C:\Program

Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all

with BitComet - res://C:\Program

Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to

Microsoft Excel - res://C:\PROGRA~1

\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-

4FCB-11CF-AAA5-00401C608501} -

C:\Program Files\Java\jre1.5.0_05

\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -

{08B0E5C0-4FCB-11CF-AAA5-

00401C608501} - C:\Program

Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: BitComet Search -

{461CC20B-FB6E-4f16-8FE8-C29359DB100E}

- C:\Program

Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: Research - {92780B25-18CC

-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1

\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8

-48C4-A200-58CAB36FD2A2} -

C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search &

Destroy Configuration - {DFB852A3-47F8-48C4

-A200-58CAB36FD2A2} -

C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-

F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows

Messenger - {FB5F1910-F110-11d2-BB9E-

00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet

Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-

9952547D5715} (Creative Software

AutoUpdate) -

http://www.creative.com/su/ocx/15030/CTSUEng.

cab
O16 - DPF: {17492023-C23A-453E-A040-

C7C580BBF700} (Windows Genuine Advantage

Validation Tool) - http://go.microsoft.com/fwlink/?

linkid=39204
O16 - DPF: {3EA4FA88-E0BE-419A-A732-

9B79B87A6ED0} (CTVUAxCtrl Object) -

http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {474F00F5-3853-492C-AC3A-

476512BBC336} (UploadListView Class) -

http://picasaweb.google.com/s/v/14.18/uploader2

.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-

2D05CB959537} (MSN Photo Upload Tool) -

http://thedashingduo.spaces.live.com//PhotoUplo

ad/MsnPUpld.cab
O16 - DPF: {55027008-315F-4F45-BBC3-

8BE119764741} (Slide Image Uploader Control)

-

http://www.slide.com/uploader/SlideImageUpload

er.cab
O16 - DPF: {5CD4310E-88FB-43C1-BE24-

5F3FA9C5C9D1} (KooPlayer Control) -

http://www.coolstreaming.us/consolle/webplus/Ko

oPlayer.ocx
O16 - DPF: {5F8469B4-B055-49DD-83F7-

62B522420ECC} (Facebook Photo Uploader

Control) -

http://upload.facebook.com/controls/FacebookPh

otoUploader.cab
O16 - DPF: {A22B8FD2-4CAA-4EFB-82F7-

680CD656D9B0} (NowStarter Control) -

http://www.gogobox.com.tw/neo.fld/GNowStarter.

cab
O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-

9DC8E6DCBCC0} (VideoEgg ActiveX Loader) -

http://update.videoegg.com/Install/Windows/Initial/

VideoEggPublisher.exe
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-

46B766368D29} (Creative Software AutoUpdate

Support Package) -

http://www.creative.com/su/ocx/15030/CTPID.cab
O18 - Protocol: livecall - {828030A1-22C1-4009

-854F-8E305202313F} - C:\PROGRA~1

\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009

-854F-8E305202313F} - C:\PROGRA~1

\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon -

C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj -

{AAA288BA-9A4C-45B0-95D7-

94D524869DB5} - C:\WINDOWS\system32

\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service

(aawservice) - Lavasoft AB - C:\Program

Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc.

- C:\Program Files\Common Files\Apple\Mobile

Device

Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown

owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Canon Camera Access Library 8

(CCALib8) - Canon Inc. - C:\Program

Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM

Access - Creative Technology Ltd -

C:\WINDOWS\system32\CTSvcCDA.EXE
O23 - Service: Google Updater Service (gusvc) -

Google - C:\Program

Files\Google\Common\Google

Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager

(IDriverT) - Macrovision Corporation -

C:\Program Files\Common

Files\InstallShield\Driver\1150\Intel 32

\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG -

C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod ?? (iPod Service) - Apple

Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Central Control

Component (PcCtlCom) - Trend Micro Inc. -

C:\PROGRA~1\TRENDM~1\INTERN~2

\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against

Spyware (PcScnSrv) - Trend Micro Inc. -

C:\PROGRA~1\TRENDM~1\INTERN~2

\PcScnSrv.exe
O23 - Service: Trend Micro Real-time Service

(Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1

\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall

(TmPfw) - Trend Micro Inc. - C:\PROGRA~1

\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service

(tmproxy) - Trend Micro Inc. - C:\PROGRA~1

\TRENDM~1\INTERN~2\tmproxy.exe
Post #2
Howdy Jowee,

Welcome to WTT. Infection is showing here, but this log as posted is very difficult to review. If you look at other request threads in our forum you will see the difference. In Notepad go to Format, and uncheck Word Wrap, and that will correct this. Let's add another look at things, and with clearer information begin some repairs.


Go Here and download Silent Runners to your desktop. Run it, and post back here the log it creates. If your AV queries the script, allow it to run. It's not malicious. It will create a file named Startup Programs, and will notify when the scan is complete. Copy the log from the Startup Programs file back here along with a new HijackThis log.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI