|
Search Tech-Forums - link takes you to our Forum's search page. Note: The following is only a text archive! To view the actual forum discussion, please visit our website at http://www.tech-forums.net Pages:1 Malware Issue(Click here to view the original thread with full colors/images)Posted by: jzak22 Hello, Could someone please take alook at my latest hijackthis log? I've tried everything on the market and keep getting hit with trogans and other coolwebsearch stuff. Any efforts would be greatly appreciated. Thanks, Jerry Posted by: southernlady Jerry, Instead of making it an attachment, just copy and paste it into your post. Also make sure it's the lastest version: 1.99.1 Liz Posted by: jzak22 Sorry and thanks for the assistance. Jerry Logfile of HijackThis v1.98.0 Scan saved at 6:57:34 AM, on 2/25/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\WINNT\System32\svchost.exe C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows 2000\FireSvc.exe C:\WINNT\system32\Hummbird\inetd32.exe C:\Program Files\Dell\OpenManage\Client\Iap.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\WINNT\system32\nutsrv4.exe C:\WINNT\system32\svchost.exe C:\WINNT\Explorer.EXE C:\WINNT\System32\hkcmd.exe C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\spywarevanisher-full\SpywareVanisher.exe C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows 2000\FireTray.exe C:\Program Files\interMute\SpySubtract\SpySub.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\WINNT\system32\svchost.exe C:\HijackThis1980.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url]http://smbusiness.dellnet.com/[/url] F0 - system.ini: Shell= F2 - REG:system.ini: UserInit=C:\WINNT\system32\userinit.exe, O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [NuTCSetupEnviron] C:\Program Files\Rational\Rational Test\nutcroot\bin\ncoeenv.exe O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKCU\..\Run: [Spyware Vanisher] C:\spywarevanisher-full\SpywareVanisher.exe -FastScan O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe O4 - Global Startup: McAfee Desktop Firewall Tray.lnk = C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows 2000\FireTray.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Rational Test Agent.lnk = C:\Program Files\Rational\Rational Test\rtprvd.exe O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = corp.rightnow.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = corp.rightnow.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = corp.rightnow.com O18 - Protocol: mlfp - {C4F82295-31F1-11D2-8E50-006008CB5184} - C:\Program Files\Mercury Interactive\Astra QuickTest\bin\ielpview.dll Posted by: jzak22 Sorry again Liz, Here is the log file using the 1.99.1 version. Logfile of HijackThis v1.99.1 Scan saved at 7:07:00 AM, on 2/28/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\WINNT\System32\svchost.exe C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows 2000\FireSvc.exe C:\WINNT\system32\Hummbird\inetd32.exe C:\Program Files\Dell\OpenManage\Client\Iap.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\WINNT\system32\nutsrv4.exe C:\WINNT\system32\svchost.exe C:\WINNT\Explorer.EXE C:\WINNT\System32\hkcmd.exe C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows 2000\FireTray.exe C:\Program Files\interMute\SpySubtract\SpySub.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\WINNT\system32\svchost.exe C:\Program Files\Cisco Systems\VPN Client\vpngui.exe C:\PROGRA~1\MICROS~2\Office\OUTLOOK.EXE C:\Program Files\Common Files\System\MAPI\1033\nt\MAPISP32.EXE C:\PROGRA~1\WINZIP\winzip32.exe C:\unzipped\hijackthis[1]\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url]http://smbusiness.dellnet.com/[/url] O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [NuTCSetupEnviron] C:\Program Files\Rational\Rational Test\nutcroot\bin\ncoeenv.exe O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKCU\..\Run: [Spyware Vanisher] C:\spywarevanisher-full\SpywareVanisher.exe -FastScan O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe O4 - Global Startup: McAfee Desktop Firewall Tray.lnk = C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows 2000\FireTray.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Rational Test Agent.lnk = C:\Program Files\Rational\Rational Test\rtprvd.exe O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = corp.rightnow.com O17 - HKLM\System\CCS\Services\Tcpip\..\{24A7414E-6BEE-4278-A4F1-0C499860C7B2}: Domain = rightnow.com O17 - HKLM\System\CCS\Services\Tcpip\..\{24A7414E-6BEE-4278-A4F1-0C499860C7B2}: NameServer = 172.22.1.123,172.22.1.10 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = corp.rightnow.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = rightnow.com O17 - HKLM\System\CS1\Services\Tcpip\..\{24A7414E-6BEE-4278-A4F1-0C499860C7B2}: Domain = rightnow.com O17 - HKLM\System\CS1\Services\Tcpip\..\{24A7414E-6BEE-4278-A4F1-0C499860C7B2}: NameServer = 172.22.1.123,172.22.1.10 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = corp.rightnow.com O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = rightnow.com O18 - Protocol: mlfp - {C4F82295-31F1-11D2-8E50-006008CB5184} - C:\Program Files\Mercury Interactive\Astra QuickTest\bin\ielpview.dll (file missing) O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe O23 - Service: McAfee Desktop Firewall Service (FireSvc) - Networks Associates Technology, Inc. - C:\Program Files\Network Associates\McAfee Desktop Firewall for Windows 2000\FireSvc.exe O23 - Service: Hummingbird Inetd (HCLInetd) - Hummingbird Communications Ltd. - C:\WINNT\system32\Hummbird\inetd32.exe O23 - Service: Iap - Dell Computer Corporation - C:\Program Files\Dell\OpenManage\Client\Iap.exe O23 - Service: Rational ClearQuest Mail Service (MailService) - Unknown owner - C:\Program Files\Rational\ClearQuest\mailservice.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe" /ServiceStart (file missing) O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: NuTCRACKERService - DataFocus, Inc. - C:\WINNT\system32\nutsrv4.exe O23 - Service: OracleOraHome92ClientCache - Unknown owner - C:\oracle\ora92\BIN\ONRSD.EXE O23 - Service: ProxyServer Service (ProxyServerService) - Rational Software - C:\Program Files\Rational\Rational Test\rtpxsr.exe O23 - Service: Rational Test Agent Service (RationalTestAgentService) - Rational Software - C:\Program Files\Rational\Rational Test\rtpsvc.exe vBulletin Copyright ©2000 - 2003, Jelsoft Enterprises Limited. PPC Management vB Easy Archive Final - Created by Xenon |