Results 1 to 6 of 6

Thread: Please help

  1. #1
    Junior Member
    Join Date
    Apr 2006
    Posts
    4

    Default Please help

    I have downloaded hijack this and this is my log.


    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\ewido anti-malware\ewidoguard.exe
    C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe
    C:\Program Files\Digital Media Reader\shwiconem.exe
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\ALCWZRD.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEA.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\sys010873567241.exe
    C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe
    C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe
    C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\LimeWire\LimeWire.exe
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\Program Files\WinRAR\WinRAR.exe
    C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.416\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
    O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
    O4 - HKLM\..\Run: [Mixersel] C:\Program Files\Realtek\InstallShield\mixersel.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [EPSON Stylus CX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEA.EXE /P26 "EPSON Stylus CX4200 Series" /O6 "USB001" /M "Stylus CX4200"
    O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\SYSC00.exe
    O4 - HKLM\..\Run: [sys010873567241] C:\WINDOWS\sys010873567241.exe
    O4 - HKLM\..\Run: [CaISSDT] "C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe"
    O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe"
    O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe"
    O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [umrq] C:\PROGRA~1\COMMON~1\umrq\umrqm.exe
    O4 - Startup: Epson all-in-one Registration.lnk = E:\Titles\Ereg\EPSONREG.exe
    O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: Applets - C:\WINDOWS\system32\q0ps0a77ed.dll (file missing)
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
    O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe

    When i run spybot search and destroy it comes up with something called command service in the registry.

    Please help!!
    I'm getting pop ups majorly. I just bought this computer too!

  2. #2
    Junior Member
    Join Date
    Apr 2006
    Posts
    4

    Default

    Ok, I ran the ewido scanner here is the report :

    + Scan result:

    :mozilla.12:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup
    :mozilla.13:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup
    :mozilla.14:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned with backup
    :mozilla.15:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
    :mozilla.16:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
    :mozilla.17:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
    :mozilla.18:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
    :mozilla.19:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
    :mozilla.20:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
    :mozilla.26:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.27:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.28:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.36:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Addynamix : Cleaned with backup
    :mozilla.37:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Addynamix : Cleaned with backup
    :mozilla.39:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
    :mozilla.40:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
    :mozilla.41:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
    :mozilla.42:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned with backup
    :mozilla.44:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Revenue : Cleaned with backup
    :mozilla.45:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
    :mozilla.46:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Adtech : Cleaned with backup
    :mozilla.50:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Searchingbooth : Cleaned with backup
    :mozilla.60:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned with backup
    :mozilla.61:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
    :mozilla.62:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
    :mozilla.63:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
    :mozilla.64:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned with backup
    :mozilla.66:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup
    :mozilla.67:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup
    :mozilla.68:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Com : Cleaned with backup
    :mozilla.71:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned with backup
    :mozilla.120:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup
    :mozilla.121:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned with backup
    :mozilla.130:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Top-banners : Cleaned with backup
    :mozilla.134:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
    :mozilla.156:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
    :mozilla.157:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
    :mozilla.158:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.2o7 : Cleaned with backup
    :mozilla.164:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup
    :mozilla.165:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup
    :mozilla.166:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup
    :mozilla.167:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup
    :mozilla.168:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup
    :mozilla.169:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup
    :mozilla.170:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup
    :mozilla.171:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup
    :mozilla.172:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup
    :mozilla.173:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Paypopup : Cleaned with backup
    :mozilla.174:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
    :mozilla.179:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned with backup
    :mozilla.185:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
    :mozilla.186:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
    :mozilla.187:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Valuead : Cleaned with backup
    :mozilla.190:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Revenue : Cleaned with backup
    :mozilla.191:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Revenue : Cleaned with backup
    :mozilla.215:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
    :mozilla.216:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
    :mozilla.217:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Onestat : Cleaned with backup
    :mozilla.218:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
    :mozilla.219:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
    :mozilla.220:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    :mozilla.221:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    :mozilla.222:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    :mozilla.223:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    :mozilla.224:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    :mozilla.230:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
    :mozilla.231:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
    :mozilla.232:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
    :mozilla.233:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
    :mozilla.234:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
    :mozilla.235:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
    :mozilla.236:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned with backup
    :mozilla.237:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
    :mozilla.238:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned with backup
    :mozilla.277:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup
    :mozilla.292:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
    :mozilla.293:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
    :mozilla.294:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Zedo : Cleaned with backup
    :mozilla.295:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.296:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.297:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.298:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    :mozilla.300:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Falkag : Cleaned with backup
    :mozilla.302:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Overture : Cleaned with backup
    :mozilla.307:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    :mozilla.308:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    :mozilla.309:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    :mozilla.310:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    :mozilla.311:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    :mozilla.312:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    :mozilla.313:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    :mozilla.314:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    :mozilla.315:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    :mozilla.316:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    :mozilla.317:C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\jgdfawpc.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned with backup
    C:\Documents and Settings\Owner\Cookies\owner@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
    C:\Documents and Settings\Owner\Cookies\owner@revenue[1].txt -> TrackingCookie.Revenue : Cleaned with backup
    C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\SH8JKNS7\send_ocx_sof[1].htm -> Not-A-Virus.Exploit.HTML.CodeBaseExec : Cleaned with backup
    C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\U7IXOTQF\send_car_int[1].htm -> Not-A-Virus.Exploit.HTML.CodeBaseExec : Cleaned with backup
    C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\U7IXOTQF\send_ocx_sof[1].htm -> Not-A-Virus.Exploit.HTML.CodeBaseExec : Cleaned with backup
    C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\WF2ZI92X\send_ocx_sof[1].htm -> Not-A-Virus.Exploit.HTML.CodeBaseExec : Cleaned with backup


    ::Report End

  3. #3
    Junior Member
    Join Date
    Apr 2006
    Posts
    4

    Default

    and the hijack report

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\ewido anti-malware\SecuritySuite.exe
    C:\Program Files\WinRAR\WinRAR.exe
    C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.094\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
    O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe
    O4 - HKLM\..\Run: [Mixersel] C:\Program Files\Realtek\InstallShield\mixersel.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [EPSON Stylus CX4200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAEA.EXE /P26 "EPSON Stylus CX4200 Series" /O6 "USB001" /M "Stylus CX4200"
    O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\SYSC00.exe
    O4 - HKLM\..\Run: [sys010873567241] C:\WINDOWS\sys010873567241.exe
    O4 - HKLM\..\Run: [CaISSDT] "C:\Program Files\CA\eTrust Internet Security Suite\caissdt.exe"
    O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVTray.exe"
    O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\CAVRID.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [umrq] C:\PROGRA~1\COMMON~1\umrq\umrqm.exe
    O4 - Startup: Epson all-in-one Registration.lnk = E:\Titles\Ereg\EPSONREG.exe
    O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O20 - Winlogon Notify: Applets - C:\WINDOWS\system32\q0ps0a77ed.dll (file missing)
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
    O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe

  4. #4
    Junior Member
    Join Date
    Apr 2006
    Posts
    4

    Default

    It looks like i have gotten rid of command service. however i'm still getting popups so i don't know what to do.

    it does not come up in spybot anymore. Nor does anything come up scanning the computer with trend micro

  5. #5
    Security Expert-Emeritus
    Join Date
    Oct 2005
    Posts
    5,025

    Default

    Welcome to the forum Mama-K

    Your running Hijackthis from a temp, not a good idea.
    Create a new folder, for instance C:\AntiSpyware
    Download the exe from here to that new folder.
    http://www.merijn.org/files/HijackThis.exe
    This is necessary to ensure you have backups should anything go wrong
    Make and post a new log

  6. #6
    Member of Team Spybot tashi's Avatar
    Join Date
    Oct 2005
    Location
    USA
    Posts
    30,961

    Default

    As the log requested has not been provided, this topic will be archived.

    If you need it re-opened please send me a pm and provide a link to the thread.
    Microsoft MVP Reconnect 2018-
    Windows Insider MVP 2016-2018
    Microsoft Consumer Security MVP 2006-2016

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •