Gladiator Security Forum > Need help with a Hijack-This Log

Full Version: Need help with a Hijack-This Log

Gladiator Security Forum > Malware Help Forum > HELP! Think you are Infected?

MacNews

Nov 28 2004, 05:04 AM

A teacher at school gave me his Hijack-This log and I was wondering if you pros could point out anything that he should remove. Thanks for the help.

QUOTE

Logfile of HijackThis v1.98.2
Scan saved at 5:39:12 PM, on 23/11/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\ESTsoft\ALZip\ALZip.exe
C:\Documents and Settings\Mom and Dad\Local Settings\Temp\_AZTMP0_\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cbc.ca/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cbc.ca
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: AdShield.AdShield - {7559B76E-0222-4d77-9499-CCE9EB4EDC2F} - C:\PROGRA~1\AdShield\AdShield\AdShield.dll
O2 - BHO: (no name) - {AF6BD22F-6F8B-29C8-1E0A-667CE5331AA5} - C:\DOCUME~1\Allison\APPLIC~1\sendgpl\Data Cake.exe
O2 - BHO: (no name) - {F4A82789-F255-2D90-4833-7D9A21E68269} - C:\PROGRA~1\sendgpl\Data Cake.exe (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [dvdbirdballdead] C:\Documents and Settings\All Users\Application Data\Tons this dvd bird\Heart Plan.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Managerpurejoysoap] C:\Documents and Settings\All Users\Application Data\Mail Lite Manager Pure\Bold Help.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Works Update Detection] ???\WkDetect.exe
O4 - HKCU\..\Run: [View ball] C:\DOCUME~1\MOMAND~1\APPLIC~1\CAMPNA~1\Lies Four.exe
O8 - Extra context menu item: &Maintain Block List... - C:\PROGRA~1\AdShield\AdShield\maintain.htm
O8 - Extra context menu item: Add to &Block List... - C:\PROGRA~1\AdShield\AdShield\suppress.htm
O8 - Extra context menu item: AdShield Option &Settings... - C:\PROGRA~1\AdShield\AdShield\settings.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: AdShield - {4FB6C25E-7B37-4c93-B592-16ECD8D18361} - C:\PROGRA~1\AdShield\AdShield\AdShield.dll (HKCU)
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/...s/yinst0401.cab
O16 - DPF: {3AF4DACE-36ED-42EF-9DFC-ADC34DA30CFF} (PatchInstaller.Installer) - file://E:\content\include\XPPatchInstaller.CAB

Bobbi Flekman

Nov 28 2004, 08:03 AM

Hi MacNews,

You might want to save this page on your favorites, so you can find it again when you return. You can also click on your name and click on "Find All Posts" to find your thread.

I see you are running AVG6 Anti-Virus from Grisoft.

Please read these links.

http://www.grisoft.com/us/us_index.php

http://free.grisoft.com/freeweb.php/doc/2/

You need to get to download AVG7 Free version when it is available as the other version will no longer give you any protection after 31st December 2004.

Please move HijackThis to another location, preferably c:\Program Files\HijackThis. Anywhere is fine, other than your Desktop or a Temp folder. If HijackThis is in a temporary folder you run the risk of accidentally deleting the backups or it clutters your desktop with all the backups.
If you use Windows XP it might be that you just double clicked on the file HijackThis.exe, but that only extracts the file to a temporary folder. Please select the file and Extract it to a folder.

How do you make a permanent folder:

Click "My Computer", then "C:\" and then on "Program Files".
In the menu bar, "File"->"New"->"Folder".
That will create a folder named "New Folder", which you can rename to "HJT" or "HijackThis".
Now you have "C:\Program Files\HijackThis". Put your HijackThis.exe there.

Run HijackThis, click on "Scan" and check the boxes next to all these items.

O2 - BHO: (no name) - {AF6BD22F-6F8B-29C8-1E0A-667CE5331AA5} - C:\DOCUME~1\Allison\APPLIC~1\sendgpl\Data Cake.exe
O2 - BHO: (no name) - {F4A82789-F255-2D90-4833-7D9A21E68269} - C:\PROGRA~1\sendgpl\Data Cake.exe (file missing)

O4 - HKLM\..\Run: [dvdbirdballdead] C:\Documents and Settings\All Users\Application Data\Tons this dvd bird\Heart Plan.exe
O4 - HKLM\..\Run: [Managerpurejoysoap] C:\Documents and Settings\All Users\Application Data\Mail Lite Manager Pure\Bold Help.exe
O4 - HKCU\..\Run: [View ball] C:\DOCUME~1\MOMAND~1\APPLIC~1\CAMPNA~1\Lies Four.exe

Then close all windows, and browsers, except HijackThis. Tell HijackThis to "Fix checked".

Restart your computer in Safe Mode. How do I Safe Boot my computer?

Show hidden files. How do I show hidden files?

Folders and files with a tilde (~), means that there is a file/folder that starts with the six characters in front of the tilde, note that there may be spaces in the name. If there are more than one, please report them back and do not delete!

Delete the following folders in red (it could be that they are deleted already):

C:\Documents and Settings\Allison\Application Data\sendgpl
C:\Program Files\sendgpl

C:\Documents and Settings\All Users\Application Data\Tons this dvd bird
C:\Documents and Settings\All Users\Application Data\Mail Lite Manager Pure
C:\Documents and Settings\MOMAND~1\Application Data\CAMPNA~1
Restart your computer and post a new log in this thread.

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.