CastleCops® hi im new...comp slowdowns/errors, please help log check

Need help? Click here to register for free! Absolutely zero advertisements on this site!

	Donation/Premium

	Donations. Become Premium Today!

	Security Central

	· Home · PIRT/Fried Phish · MIRT · SIRT · Deutsch · Wiki · Newsletter · O16/ActiveX · CLSID List · Contest2007 · Downloads · Feedback (send) · Forums · HijackThis · Hijacktrend · LSPs · My Downloads · O18 · O20 · O21 · O22 · O23 · O9 · Premium · Private Messages · Proxomitron · Reviews · Search · StartupList · Stories Archive · Submit News · WsIRT · Your Account · Acceptable Use Policy

Forum FAQ

Usergroups

Profile

Select FavForums

possible hijack

All -> FavForums -> Trend Micro HijackThis Logs

[del.icio.us!] [digg it!] [reddit!]

View previous topic :: View next topic

Author

Message

Nsonic

Guest
IP: 220.240.*.*

Posted: Tue Dec 02, 2003 12:48 pm Post subject: possible hijack

when i was about to look for a solution for the searcdot.net hijack problem, i couldn't get to google...it would take a few seconds after i tyed it in, and then redirect me to some other site or a site thats in my history i cleared my temporary internet files and history and it seems to work now. but im not sure if its one of those regenerating ones. so was google hacked for a few mins? or was it the searchdot.net hijack? or was is a completely different one? i appreciate any help with this

Bulldog

General

Premium Member

Joined: Nov 16, 2003
Posts: 4375
Location: Canada

Posted: Tue Dec 02, 2003 2:27 pm Post subject:

Please post a HJT log for review. Download 'Hijack This!'. http://www.tomcoyote.org/hjt/ Unzip, doubleclick HijackThis.exe, and hit "Scan". When the scan is finished, the "Scan" button will change into a "Save Log" button. Press that, then Ctrl-A to Select All, and copy its contents here. Most of what it lists will be harmless or even essential, don't fix anything yet. _________________ Cheers.

Nsonic

Guest
IP: 220.240.*.*

Posted: Thu Dec 04, 2003 5:02 am Post subject:

Logfile of HijackThis v1.97.7 Scan saved at 4:14:24 PM, on 4/12/2003 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE E:\Program Files\PestPatrol\PPMemCheck.exe C:\PROGRA~1\DAP\DAP.EXE C:\WINDOWS\System32\rundll32.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\System32\NotifyPhoneBook.exe C:\Program Files\NoAds\NoAds.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe C:\Program Files\SpamPal\spampal.exe C:\Program Files\Trend Micro\PC-cillin 2002\WebTrap.EXE C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\BitTorrent++\BT++.exe C:\PROGRA~1\WINZIP\winzip32.exe C:\Documents and Settings\Nelson Mok\Local Settings\Temp\HijackThis.exe O1 - Hosts: 38.115.131.131 sk2.slsk.org O1 - Hosts: 38.115.131.131 www.slsk.org O1 - Hosts: 38.115.131.131 mail.slsk.org O1 - Hosts: 38.115.131.131 server.slsk.org O1 - Hosts: 38.115.131.131 sk2.slsk.org O1 - Hosts: 38.115.131.131 www.slsk.org O1 - Hosts: 38.115.131.131 mail.slsk.org O1 - Hosts: 38.115.131.131 server.slsk.org O2 - BHO: (no name) - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll O2 - BHO: (no name) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 6\SnagItBHO.dll O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 6\SnagItIEAddin.dll O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe" O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe" O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe" O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE O4 - HKLM\..\Run: [PPMemCheck] "E:\Program Files\PestPatrol\PPMemCheck.exe" O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL O4 - HKLM\..\Run: [Msoffice] C:\WINDOWS\Fonts\msoffice.hta O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [NoAds] "C:\Program Files\NoAds\NoAds.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Msoffice] C:\WINDOWS\Fonts\msoffice.hta O4 - HKCU\..\Run: [Homepage Guard] "C:\Program Files\HGuard\Guard.exe" O4 - Startup: SpamPal.lnk = C:\Program Files\SpamPal\spampal.exe O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: Run DAP (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://www.ea.com/downloads/rtpatch/EARTPX.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{309D8E5A-80E0-4075-AA86-578A4D4AD2C8}: NameServer = 203.194.56.150 203.194.27.57 O17 - HKLM\System\CS2\Services\Tcpip\..\{309D8E5A-80E0-4075-AA86-578A4D4AD2C8}: NameServer = 203.194.56.150 203.194.27.57

tb525

Lieutenant

Joined: Dec 03, 2003
Posts: 188
Location: USA

Posted: Thu Dec 04, 2003 9:36 am Post subject:

Download, unzip and run CWShredder. After running CWS, reboot and run Hijack again and post a new log. http://www.spywareinfo.com/~merijn/files/cwshredder.zip

Nsonic

Guest
IP: 220.240.*.*

Posted: Thu Dec 04, 2003 10:28 am Post subject:

Logfile of HijackThis v1.97.7 Scan saved at 9:39:32 PM, on 4/12/2003 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Trend Micro\PC-cillin 2002\Tmntsrv.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE C:\PROGRA~1\DAP\DAP.EXE C:\WINDOWS\System32\rundll32.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\System32\NotifyPhoneBook.exe C:\Program Files\NoAds\NoAds.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe C:\Program Files\SpamPal\spampal.exe C:\Program Files\Trend Micro\PC-cillin 2002\WebTrap.EXE C:\Program Files\BitTorrent++\BT++.exe C:\Program Files\Kazaa Lite\Speed Up.exe C:\PROGRA~1\WINZIP\winzip32.exe C:\Documents and Settings\Nelson Mok\Local Settings\Temp\HijackThis.exe O1 - Hosts: 38.115.131.131 sk2.slsk.org O1 - Hosts: 38.115.131.131 www.slsk.org O1 - Hosts: 38.115.131.131 mail.slsk.org O1 - Hosts: 38.115.131.131 server.slsk.org O1 - Hosts: 38.115.131.131 sk2.slsk.org O1 - Hosts: 38.115.131.131 www.slsk.org O1 - Hosts: 38.115.131.131 mail.slsk.org O1 - Hosts: 38.115.131.131 server.slsk.org O2 - BHO: (no name) - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll O2 - BHO: (no name) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 6\SnagItBHO.dll O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 6\SnagItIEAddin.dll O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\pccguide.exe" O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\PCCClient.exe" O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\PC-cillin 2002\Pop3trap.exe" O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE O4 - HKLM\..\Run: [PPMemCheck] "E:\Program Files\PestPatrol\PPMemCheck.exe" O4 - HKLM\..\Run: [DownloadAccelerator] C:\PROGRA~1\DAP\DAP.EXE /STARTUP O4 - HKLM\..\Run: [AME_CSA] rundll32 amecsa.cpl,RUN_DLL O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [NoAds] "C:\Program Files\NoAds\NoAds.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Homepage Guard] "C:\Program Files\HGuard\Guard.exe" O4 - Startup: SpamPal.lnk = C:\Program Files\SpamPal\spampal.exe O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM) O9 - Extra button: Run DAP (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdate/content/opuc.cab O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://www.ea.com/downloads/rtpatch/EARTPX.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{309D8E5A-80E0-4075-AA86-578A4D4AD2C8}: NameServer = 203.194.56.150 203.194.27.57 O17 - HKLM\System\CS2\Services\Tcpip\..\{309D8E5A-80E0-4075-AA86-578A4D4AD2C8}: NameServer = 203.194.56.150 203.194.27.57

Nsonic

Guest
IP: 220.240.*.*

Posted: Fri Dec 05, 2003 4:29 am Post subject:

..sometimes when im redirected..i seem to always go to sega.com, and once an ad on a page was the sega.com site, not an ad for sega, but the actual webpage was the ad...and i could navigate it as well

OrphanAnnie

Security Expert

Joined: Dec 04, 2003
Posts: 2278

Posted: Sat Dec 06, 2003 4:56 am Post subject:

Hi Nsonic - close all opne windows and run Hijack This again. Select the below entries and click on Fix Selected. Reboot afterwards. O1 - Hosts: 38.115.131.131 sk2.slsk.org O1 - Hosts: 38.115.131.131 www.slsk.org O1 - Hosts: 38.115.131.131 mail.slsk.org O1 - Hosts: 38.115.131.131 server.slsk.org O1 - Hosts: 38.115.131.131 sk2.slsk.org O1 - Hosts: 38.115.131.131 www.slsk.org O1 - Hosts: 38.115.131.131 mail.slsk.org O1 - Hosts: 38.115.131.131 server.slsk.org When you have rebooted, run Hijack This again and post back a new log. Also let us know if you are still having problems. _________________ Microsoft MVP - Windows Desktop Experience 2004-2008

	All -> FavForums -> Trend Micro HijackThis Logs	All times are GMT
Page 1 of 1

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


	2002-2008 � Computer Cops LLC dba CastleCops®. All rights reserved. Acceptable Use Policy. Use signifies your agreement. 164ppm 0.237s (0.053s) Making cybercriminals unhappy since 2002*