malwarebytes/hijackthis logs.

The_Grandmaster

Please update definitions and run a FULL scan.

And just copy the hijack this log please as it shows.

23n1th

I can't cos I'm on linux but maybe someone come show kduffy what everyone is trying to get kduffy to do. An example??

wendy05

http://www.whatthetech.com/hijackthis/

and also

http://hjt.networktechs.com/

and an example log is:

http://community.trendmicro.com/t5/Malware-Discussions/I-need-help-with-hijack-this-log/m-p/6361

kduffy101

i keep trying to save the log as it should be,but this is not my pc,i cant get it to save the correct way,ive unchecked wordwrap but it keeps coming out the same way.any help would be great,sorry for any inconvenience.

atomicskipper

How can I check a logfile against a data base instead of one by one. New to this.

aliEnRIK

Its happened on both malwarebytes and hijack so its clearly whatever program your using to open the logs (It should be 'notepad')

make sure wordwrap is unticked then redo a log (ie, run hijack again)

wendy05

ok - ive tidied it up for you, check it against your original for any errors.





Logfile of Trend Micro HijackThis v2.0.4


Scan saved at 20:26:33, on 19/10/2010


Platform: Windows XP SP3 (WinNT 5.01.2600)


MSIE:Internet Explorer v8.00 (8.00.6001.18702)


Boot mode: NormalRunning


processes:


C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exe


C:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exe


C:\WINDOWS\system32 \svchost.exeC:\WINDOWS\System32\svchost.exe


C:\Prog ram Files\Alwil Software\Avast5\AvastSvc.exe


C:\WINDOWS\system32\spoolsv.exe


C:\WINDOWS\Explorer.EXE


C:\WINDOWS\ehome\ehtray.exe


C:\WINDOWS\RTHDCPL.EXE


C:\Program Files\Alwil Software\Avast5\avastUI.exe


C:\Program Files\Common Files\AOL\ACS\AOLDial.exe


C:\Program Files\iTunes\iTunesHelper.exe


C:\Program Files\QuickTime\qttask.exe


C:\Program Files\AOL 9.0\aoltray.exe


C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacs d.exe


C:\WINDOWS\arservice.exe


C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


C:\WI NDOWS\system32\nvsvc32.exe


C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


C:\Program Files\iPod\bin\iPodService.exeC:\HP\KBD\KBD.EXE


c:\ windows\system\hpsysdrv.exe


C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe


C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe


C:\WINDOWS\system32\ctfmon.exe


C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe


C:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exe


C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe


C:\Program Files\Internet Explorer\iexplore.exe


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sky.com


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TY...O&pf=desktopR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.yahoo.com/


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157


R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided By Sky BroadbandR3 - URLSearchHook: (no name) - - (no file)


R3 - URLSearchHook: ToolbarURLSearchHook Class - {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files\Fast Browser Search\IE\tbhelper.dll (file missing)


O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll


O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll


O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll


O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll


O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5627.1104\s wg.dll


O3 - Toolbar: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)


O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll


O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe


O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode


O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE


O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXEO4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE


O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run


O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui


O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe


O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup


O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot


O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup


O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime


O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe"


O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')


O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')


O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')


O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')


O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe


O4 - Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe


O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe


O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2D06 158FAC79A790.dll/cmsidewiki.html


O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll


O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll


O9 - Extra button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com (file missing)


O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm


O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm


O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204


O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} – C:\WINDOWS\system32\browseui.dll


O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} – C:\WINDOWS\system32\browseui.dll


O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe


O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe


O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe


O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe


O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe


O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe


O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe


O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe


O23 - Service: LiveUpdate - Symantec Corporation –
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE


O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation – C:\WINDOWS\system32\nvsvc32.exe


O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe--


End of file - 8556 bytes

The_Grandmaster

So you're running avast at the moment right? You have remnants of norton left. Remove these with: http://service1.symantec.com/Support...05033108162039

R3 - URLSearchHook: ToolbarURLSearchHook Class - {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files\Fast Browser Search\IE\tbhelper.dll (file missing)
O3 - Toolbar: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)

are not good in the log. Remove these from the control panel or if can not be found rerun hijackthis, TICK these two entries and remove them.

kduffy101

wendy05 thanks very much for doing that for me,
thanks to the grandmaster aswell,
i took the pc back to my sister inlaw today,but i will get it back tomorrow+fix the above issues,
the other problem i encountered was it was tell me that java script was turned off+something else about enableing cookies,some web sites were showing a blank page,
if anyone can point me in the right direction to fix these 2 issues it will save me from posting another new thread tomorrow.
a big thanks to all who commented+keep up the good work.:j

wendy05

kduffy101 wrote: »

wendy05 thanks very much for doing that for me,
thanks to the grandmaster aswell,
i took the pc back to my sister inlaw today,but i will get it back tomorrow+fix the above issues,
the other problem i encountered was it was tell me that java script was turned off+something else about enableing cookies,some web sites were showing a blank page,
if anyone can point me in the right direction to fix these 2 issues it will save me from posting another new thread tomorrow.
a big thanks to all who commented+keep up the good work.:j

ok it looks as if you are using internet explorer 8 , if so
http://windows.microsoft.com/en-US/windows-vista/Block-or-allow-cookies

javascript : http://www.tranexp.com/win/JavaScript-enabling.htm

you can also maybe add another browser to firefox which has more control and you can add extra tweaks and it is thought to be better for security issues.

http://www.mozilla.com/en-US/

ps. google is your friend