User Name
Password

Go Back   Planetarion Forums > Non Planetarion Discussions > Programming and Discussion > Hardware and Tech Support
Reload this Page Hijack this log for flav <3

Reply
View First Unread View First Unread  
Thread Tools Display Modes
Unread 1 Nov 2005, 17:48   #1
JammyJim
Godfather
 
JammyJim's Avatar
 
Join Date: May 2000
Location: England
Posts: 5,185
JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.
Hijack this log for flav <3
Logfile of HijackThis v1.99.1
Scan saved at 04:44:01 PM, on 01/11/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Razer\razerhid.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
C:\Program Files\ABIT\ABIT uGuru\GuruClock.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\UltraMon\UltraMon.exe
C:\Program Files\PestPatrol\PPControl.exe
C:\Program Files\ABIT\ABIT uGuru\uGuru_Event_Receiver.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\UltraMon\UltraMonTaskbar.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Desktop Modification\tclocklite\tclock.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Razer\razertra.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Razer\razerofa.exe
C:\Mirc\mirc.exe
C:\Program Files\Microsoft AntiSpyware\GIANTAntiSpywareMain.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\James.XASER.001\Local Settings\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [razer] C:\Program Files\Razer\razerhid.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [ABIT uGuru] C:\Program Files\ABIT\ABIT uGuru\uGuru.exe
O4 - HKLM\..\Run: [GuruClock] C:\Program Files\ABIT\ABIT uGuru\GuruClock.exe
O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.0 RC 15.7\RivaTuner.exe" /S
O4 - HKLM\..\Run: [UltraMon] "C:\Program Files\UltraMon\UltraMon.exe" /auto
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\Program Files\PestPatrol\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - Startup: Konfabulator.lnk = C:\Program Files\Pixoria\Konfabulator\Konfabulator.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Shortcut to tclock.lnk = C:\Desktop Modification\tclocklite\tclock.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .aac: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O15 - Trusted Zone: http://www.lyricshosting.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} (Download Helper Class) - http://activex.microgaming.com/dlhel...7/dlhelper.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697519} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp6_aac.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
__________________
Forum Administrator
Mail : [email protected] // IRC : #forums
__________________
It's not personal, it's just business.
JammyJim is offline   Reply With Quote
Unread 1 Nov 2005, 17:54   #2
JammyJim
Godfather
 
JammyJim's Avatar
 
Join Date: May 2000
Location: England
Posts: 5,185
JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.
Re: Hijack this log for flav <3
heh
__________________
Forum Administrator
Mail : [email protected] // IRC : #forums
__________________
It's not personal, it's just business.
JammyJim is offline   Reply With Quote
Unread 1 Nov 2005, 19:06   #3
JammyJim
Godfather
 
JammyJim's Avatar
 
Join Date: May 2000
Location: England
Posts: 5,185
JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.
Re: Hijack this log for flav <3
the popups have stopped so presumably something ive run has finally nabbed it.

im using avast atm to do a virus sweep and clean up anything i might have missed :/

odd how hijack this didnt even show it up tho
__________________
Forum Administrator
Mail : [email protected] // IRC : #forums
__________________
It's not personal, it's just business.
JammyJim is offline   Reply With Quote
Unread 1 Nov 2005, 19:38   #4
flapjack
crashed computer
 
Join Date: Jan 2001
Posts: 2,257
flapjack is infamous around these parts
Re: Hijack this log for flav <3
You, JJ, have an awfull lot of stuff running...
__________________
IRC quotes:
<Walrus> Let's all poke him next time he appears.
<Heiro> I think that is wise, Master Walrus

<Gryffin> ungrateful wretches
<Gryffin> they should be here!
<Gryffin> so I can grace them with my presence
flapjack is offline   Reply With Quote
Unread 1 Nov 2005, 19:50   #5
Androme
☆ ♥ 
 
Androme's Avatar
 
Join Date: Jan 2003
Posts: 3,489
Androme can only hope to improve
Re: Hijack this log for flav <3
Download SpywareBlaster from javacoolsoftware
__________________
R3: LegioN (came #32) || R4: BlueTuba
R5: WolfPack Order || R6: Wolfpack
R7: Fury
----------retired-------
R52-R55: Apprime
R56-R57: FaceLess
R58-60: Apprime/Ultores
Androme is offline   Reply With Quote
Unread 2 Nov 2005, 01:24   #6
JammyJim
Godfather
 
JammyJim's Avatar
 
Join Date: May 2000
Location: England
Posts: 5,185
JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.
Re: Hijack this log for flav <3
i have no spyware. i did have adtmd or some crap that nothing would detect but clearly something (either virus software or one of the multitude of scanner jobbies) has found and removed it because its stopped popping up ads from time to time. hijack this was clear tho. just full of shit.

i could do with streamlining what runs really. it used to be much smaller :-(
__________________
Forum Administrator
Mail : [email protected] // IRC : #forums
__________________
It's not personal, it's just business.
JammyJim is offline   Reply With Quote
Unread 2 Nov 2005, 08:43   #7
jupp
Hi there ...
 
jupp's Avatar
 
Join Date: May 2004
Posts: 481
jupp has a brilliant futurejupp has a brilliant futurejupp has a brilliant futurejupp has a brilliant futurejupp has a brilliant futurejupp has a brilliant futurejupp has a brilliant futurejupp has a brilliant futurejupp has a brilliant futurejupp has a brilliant futurejupp has a brilliant future
Re: Hijack this log for flav <3
i had a similar problem - i think i fixed it with Browser Hijack Recovery (BHR)

still i am not sure because i ran quite some removing tools to kill those pop ups!
__________________
#Reunion

[Ascendancy] - While you were trying, we were sleeping
jupp is offline   Reply With Quote
Unread 15 Nov 2005, 12:14   #8
djbass
mmm.. pills
 
djbass's Avatar
 
Join Date: Apr 2000
Location: Australia
Posts: 2,152
djbass has a reputation beyond reputedjbass has a reputation beyond reputedjbass has a reputation beyond reputedjbass has a reputation beyond reputedjbass has a reputation beyond reputedjbass has a reputation beyond reputedjbass has a reputation beyond reputedjbass has a reputation beyond reputedjbass has a reputation beyond reputedjbass has a reputation beyond reputedjbass has a reputation beyond repute
Re: Hijack this log for flav <3
Generally speaking I've never failed yet to remove malacious software by multiple runs of ad-aware & spybot followed up by trend-micro's housecall. The only key points to note are that you need to run it in safe mode, otherwise the processes are likely to still be running and it will only re-infect your system again, for the same reason it's often required to run multiple times until the software has sucessfully pruned back and weeded out every last part.

Very occasionally you'll still have that one last bugger that wants to hang on, that's when it's best to lookup the specific malware and find out how to remove it manually, often with brute force.

Oh, and JJ your computer had Air Defense/Theater Missile Defense? that's some heavy duty protection man
__________________
CSS : the result of letting artists design something only an engineer should touch.
djbass is offline   Reply With Quote
Unread 15 Nov 2005, 13:43   #9
JammyJim
Godfather
 
JammyJim's Avatar
 
Join Date: May 2000
Location: England
Posts: 5,185
JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.JammyJim has ascended to a higher existance and no longer needs rep points to prove the size of his e-penis.
Re: Hijack this log for flav <3
The worst one i found was Zestyfind.

It took a lot of messing about to get rid of it including a boot into the windows recovery console until the bugger was finally destroyed. That was for a mates PC at uni and it took a 'fair bit of time' to work out how to remove it.

My brothers pc is usually gummed up too. It has required more than just a 'standard scan and remove' job to get rid of some of it. Usually deleting the system restore files, booting into safemode and/or recovery console to get rid of it all.

Then 2 weeks later its in the same mess again

damn him


p.s. about the protection :

On Nb3's advice i now run Avast instead of AVG which does a fair job and MS antispyware for catching any changes to windows settings. in addition to that i have spybot search and destroy which runs every now and again and immunises my system and also lavasoft adaware se which is also ruin from time to time.

the ppmemcheck and ppcookiepatrol are part of pestpatrol which while being quite good with some of the more trickier things eats resources if its ever loaded so all of its various 'bits and bobs' are stopped from running at startup.
__________________
Forum Administrator
Mail : [email protected] // IRC : #forums
__________________
It's not personal, it's just business.
JammyJim is offline   Reply With Quote
Reply

« Previous Thread | Hardware and Tech Support | Next Thread »

Thread Tools
Display Modes
Linear Mode Linear Mode

Forum Jump


All times are GMT +1. The time now is 22:07.
Planetarion - Top

Powered by vBulletin® Version 3.8.1
Copyright ©2000 - 2024, Jelsoft Enterprises Ltd.
Copyright ©2002 - 2018