What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Toolbar Hijack Log...

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Having trouble with crashes and blue screen of death… Should these registry entries that show up in my hijack log file be removed? :scratch: Thanks for looking! O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file) O3 - Toolbar: (no name) - {DF2A50AF-2EDF-44A1-83F6-1D6A2ECC9FBD} - (no file) O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-D3FA-F27BA787AD2D} - (no file) O3 - Toolbar: (no name) - {CD7E5365-FA1E-4123-9BFF-C8D55AFFAB1F} - (no file) O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467}
Post #2
Here is the full Hijack log file.

My symptoms are slowness, crashes, blue screen and random reboots :(



Logfile of HijackThis v1.97.7
Scan saved at 3:09:19 AM, on 5/28/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\3CMLNKW.EXE
C:\PROGRAM FILES\NORTON UTILITIES\NPROTECT.EXE
C:\PROGRAM FILES\FREEMEM PROFESSIONAL\FMEMPRO.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\TEATIMER.EXE
C:\1\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.customchat.com
R1 - HKCU\Software\Microsoft\Internet Explorer,Default_Search_URL = http://www.w50.com/sw/searchbar/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.chatalot.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.customchat.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = punktv.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = chatalot.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = punktv.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = communitybridge.com/gallery
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = punktv.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = punktv.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = punktv.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = eternalflame.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = punktv.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = punktv.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = BoingBoingBoing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\system32\blank.htm
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: (no name) - {DF2A50AF-2EDF-44A1-83F6-1D6A2ECC9FBD} - (no file)
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-D3FA-F27BA787AD2D} - (no file)
O3 - Toolbar: (no name) - {CD7E5365-FA1E-4123-9BFF-C8D55AFFAB1F} - (no file)
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [3Cmlink] C:\WINDOWS\SYSTEM\3cmlnkW.exe
O4 - HKLM\..\Run: [Norton] C:\Program Files\Norton AntiVirus\navapw32.exe
O4 - HKLM\..\Run: [NPROTECT] C:\Program Files\Norton Utilities\NPROTECT.EXE
O4 - HKLM\..\Run: [IntruderAlert] C:\Program Files\Internet Alert\ia99.exe
O4 - HKCU\..\Run: [FreeMem Pro] "C:\PROGRAM FILES\FREEMEM PROFESSIONAL\FMEMPRO.EXE" autostart
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .asp: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\NPSWF32.dll
O12 - Plugin for .avi: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O13 - WWW. Prefix: http://
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…ector/swdir.cab
O16 - DPF: {156731E1-D652-11D1-BE03-00A0C9111212} (ATLSBNCheck Class) - http://msdn.microsoft.com/downloads/sbncheck.cab
O16 - DPF: {0FC6BF2B-E16A-11CF-AB2E-0080AD08A326} -
O16 - DPF: {017C99A0-8637-11CF-A3A9-00A0C9034920} (Gradient Object) - http://activex.microsoft.com/activex/contr…/x86/iegrad.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security2.norton.com/us/sa/common/c…n/bin/cabsa.cab
O16 - DPF: {1FB464C8-09BB-4017-A2F5-EB742F04392F} (Microsoft Terminal Services Control (redist)) - http://asp.terminal.com/mstscax.cab
O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.141/code/PWActiveXImgCtl.CAB
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/1574beeb858d4440ff03/…ip/RdxIE601.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7889.5586805556
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004033…all/xscan53.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
Post #3
I would fix these:

R1 - HKCU\Software\Microsoft\Internet Explorer,Default_Search_URL = http://www.w50.com/sw/searchbar/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\system32\blank.htm

O3 - Toolbar: (no name) - {DF2A50AF-2EDF-44A1-83F6-1D6A2ECC9FBD} - (no file)

O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-D3FA-F27BA787AD2D} - (no file)

O3 - Toolbar: (no name) - {CD7E5365-FA1E-4123-9BFF-C8D55AFFAB1F} - (no file)

O16 - DPF: {0FC6BF2B-E16A-11CF-AB2E-0080AD08A326} -

O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.141/code/PWActiveXImgCtl.CAB

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/1574beeb858d4440ff03/…ip/RdxIE601.cab


At least one search I did, said that this is "spyware":

O4 - HKLM\..\Run: [IntruderAlert] C:\Program Files\Internet Alert\ia99.exe

You decide whether to keep that one or not.

Then, fix any of these you do not recognize:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.customchat.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.chatalot.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.customchat.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = punktv.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = chatalot.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = punktv.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = communitybridge.com/gallery

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = punktv.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = punktv.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = punktv.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = eternalflame.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = punktv.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = punktv.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = BoingBoingBoing

Reboot, and see if your machine functions better. :)
Post #4
Thanks so much for the help - things did clear up a bit. I have noticed that some of these things you advised to remove have reappeared…
these 3 specifically:

O16 - DPF: {0FC6BF2B-E16A-11CF-AB2E-0080AD08A326} -

O16 - DPF: {6B4788E2-BAE8-11D2-A1B4-00400512739B} (PWMediaSendControl Class) - http://216.249.24.141/code/PWActiveXImgCtl.CAB

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/1574beeb858d4440ff03/…ip/RdxIE601.cab


I am now removing them again. The comp is almost back to normal now… still a few crashes, but I can now open programs that were a gauranteed crash before.

One other strange thing is my CD burner is now refusing to burn discs - even tho it says the disc was successfully burned. It was working fine before this trojan war - has anyone ever heard of a CD rom being affected by viri and trojans?
Post #5
Thanks in advance if anyone has the time to look over my new hijack log file - I made this log after removing the 3 lines mentioned in last post:


Logfile of HijackThis v1.97.7
Scan saved at 1:34:05 AM, on 6/5/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\3CMLNKW.EXE
C:\PROGRAM FILES\FREEMEM PROFESSIONAL\FMEMPRO.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\COMMON FILES\BULLGUARD\BULLGUARD COMMUNICATOR\XCOMMSVR.EXE
C:\PROGRAM FILES\COMMON FILES\BULLGUARD\BULLGUARD SCAN SERVER\BDSS.EXE
C:\PROGRAM FILES\BULLGUARD\VSSERV.EXE
C:\PROGRAM FILES\BULLGUARD\BDMCON.EXE
C:\1\HIJACKTHIS\HIJACKTHIS.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.customchat.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.chatalot.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.customchat.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = punktv.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = chatalot.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = punktv.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = communitybridge.com/gallery
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = punktv.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = punktv.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = punktv.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = eternalflame.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = punktv.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = punktv.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = BoingBoingBoing
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [3Cmlink] C:\WINDOWS\SYSTEM\3cmlnkW.exe
O4 - HKLM\..\Run: [BullGuard Virus Shield] C:\Program Files\BullGuard\\vsserv.exe
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\BULLGU~1\BDMCON.EXE
O4 - HKLM\..\Run: [LexStart] Lexstart.exe
O4 - HKLM\..\RunServices: [BullGuard Scan Server] C:\Program Files\Common Files\BullGuard\BullGuard Scan Server\\bdss.exe
O4 - HKLM\..\RunServices: [BullGuard Communicator] C:\Program Files\Common Files\BullGuard\BullGuard Communicator\\xcommsvr.exe
O4 - HKLM\..\RunServices: [BullGuard Live! Init] C:\Program Files\BullGuard\\bdinit.exe
O4 - HKCU\..\Run: [FreeMem Pro] "C:\PROGRAM FILES\FREEMEM PROFESSIONAL\FMEMPRO.EXE" autostart
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O12 - Plugin for .asp: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\NPSWF32.dll
O12 - Plugin for .avi: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O12 - Plugin for .pdf: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\nppdf32.dll
O13 - WWW. Prefix: http://
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa…ash/swflash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwa…ector/swdir.cab
O16 - DPF: {156731E1-D652-11D1-BE03-00A0C9111212} (ATLSBNCheck Class) - http://msdn.microsoft.com/downloads/sbncheck.cab
O16 - DPF: {017C99A0-8637-11CF-A3A9-00A0C9034920} (Gradient Object) - http://activex.microsoft.com/activex/contr…/x86/iegrad.cab
O16 - DPF: {1FB464C8-09BB-4017-A2F5-EB742F04392F} (Microsoft Terminal Services Control (redist)) - http://asp.terminal.com/mstscax.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/…7889.5586805556
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} -
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} -
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} -
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} -
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} -
Post #6
The log file looks clean of malware and electronic organisms (virii, trojans, and worms).

This item could be "fixed" with Hijack This!:

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)

Other than that, you're looking clean.

About those "O16" entries.

All entries that start with "O16" are "Active-X" items downloaded to your machine from websites. If they are "fixed" with Hijack This!, and you revisit that website, they will get downloaded again. So, don't be alarmed if some "reappear" unless it is detemined they are malicious. Some "O16" entries can be malicious and cause problems on your machine.

The ones you have look to be harmless.

If you are still experiencing random reboots, and slowdowns of your machine, I would suggest a free online virus scan/removal (use the link in my signature) from Trend-Micro. Although you have resident antiviral software, a "2nd opinion" isn't a bad idea. Some items that can affect your machine do not show up in a Hijack This! log file.

M68 :)
Post #8
Glad we could help :D

As this problem has been resolved the topic will be closed. If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)

The subject of the email must be "Reopen". Include your post username and details about why you need it reopened, with a valid link to your post.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI