MyTechSupport.ca :: Your Computer Technical Resource Headquarters! MyTechSupport.ca :: Your Computer Technical Resource Headquarters!
HOME FORUMS RESOURCES & TOOLS ARTICLES ONLINE STORE ABOUT US
Computer Support Forums arrow Internet & Network Support arrow Security & Viruses arrow Topic: res://c:\windows\system32 problem...
June 17, 2019, 06:20:44 AM
 

Home Forum Rules Help Search Mobile Version Login Register

Welcome, Guest. Please login or register.
Did you miss your activation email?
June 17, 2019, 06:20:44 AM

Login with username, password and session length
 
News
New  New Poll on our main page!
"My experience with Vista..."
  0 Members and 1 Guest are viewing this topic.
Pages: [1] Go Down Print
Author Topic: res://c:\windows\system32 problem...  (Read 3320 times)
CrazyJo82
Sr. Member
****

Karma: +0/-0
Offline Offline

Gender: Female
Posts: 102


Bookmark and Share

View Profile
« on: July 19, 2004, 03:18:30 PM »

I'm trying to fix another computer that's running on XP but there are so many spyware and virus that I'm not even sure which is which. There are some files that are imitating as critical files in the c:\windows\system folder.

Here's the hijackthis log...


Logfile of HijackThis v1.98.0
Scan saved at 11:15:24 AM, on 19/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\crck.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\msadvapi.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\USB Multimedia keyboard driver\kb_2k.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Sum one\Desktop\Programs\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\dpnkg.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://dpnkg.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://dpnkg.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\dpnkg.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\dpnkg.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://dpnkg.dll/index.html#37049
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {F1B29D9E-77D4-3911-26FA-4DF52CC3DF6D} - C:\WINDOWS\ntvz.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [SpyBlocs] C:\Program Files\SpyBlocs\SpyBlocs.exe
O4 - HKLM\..\Run: [SysInit] wininit32.exe -drivers
O4 - HKLM\..\Run: [aeilwadpi] C:\WINDOWS\System32\pinjgx.exe
O4 - HKLM\..\Run: [ogonuil] C:\WINDOWS\System32\ogonuil.exe
O4 - HKLM\..\Run: [sfsipca] C:\WINDOWS\System32\sfsipca.exe
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [msadvapi32] msadvapi.exe
O4 - HKLM\..\RunServices: [SysInit] wininit32.exe -drivers
O4 - HKLM\..\RunOnce: [mfcyn.exe] C:\WINDOWS\mfcyn.exe
O4 - HKLM\..\RunOnce: [ipjm.exe] C:\WINDOWS\system32\ipjm.exe
O4 - HKLM\..\RunOnce: [netzd.exe] C:\WINDOWS\system32\netzd.exe
O4 - HKLM\..\RunOnce: [msah.exe] C:\WINDOWS\system32\msah.exe
O4 - HKLM\..\RunOnce: [mfcpm32.exe] C:\WINDOWS\mfcpm32.exe
O4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1014.dll,InstantAccess
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SysInit] wininit32.exe -drivers
O4 - HKCU\..\Run: [msadvapi32] msadvapi.exe
O4 - HKCU\..\Run: [warez] "C:\Program Files\Warez P2P Client\warez.exe" -h
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: USB Multimedia keyboard driver.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll



The list is already shorted before there are more then 50 things running on startup under RunOnce.

I've ran Spybot and adaware and a virus scan... most stuff are gone. I've also tried AboutBuster but it doesn't seem to remove all the virus...
« Last Edit: July 20, 2004, 10:38:48 PM by CrazyJo82 » Logged

 
CrazyJo82
Sr. Member
****

Karma: +0/-0
Offline Offline

Gender: Female
Posts: 102


Bookmark and Share

View Profile
« Reply #1 on: July 19, 2004, 03:54:54 PM »

An Updated HijackThis report:

Logfile of HijackThis v1.98.0
Scan saved at 11:55:02 AM, on 19/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\msadvapi.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\USB Multimedia keyboard driver\kb_2k.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\AnswersThatWork\Troubleshooter\UltimateTroubleshooter.exe
C:\Program Files\AnswersThatWork\Troubleshooter\UltimateTroubleshooter.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Sum one\Desktop\Programs\HijackThis.exe

R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {F1B29D9E-77D4-3911-26FA-4DF52CC3DF6D} - C:\WINDOWS\ntvz.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [SpyBlocs] C:\Program Files\SpyBlocs\SpyBlocs.exe
O4 - HKLM\..\Run: [SysInit] wininit32.exe -drivers
O4 - HKLM\..\Run: [aeilwadpi] C:\WINDOWS\System32\pinjgx.exe
O4 - HKLM\..\Run: [ogonuil] C:\WINDOWS\System32\ogonuil.exe
O4 - HKLM\..\Run: [sfsipca] C:\WINDOWS\System32\sfsipca.exe
O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [msadvapi32] msadvapi.exe
O4 - HKLM\..\RunServices: [SysInit] wininit32.exe -drivers
O4 - HKLM\..\RunOnce: [mfcyn.exe] C:\WINDOWS\mfcyn.exe
O4 - HKLM\..\RunOnce: [ipjm.exe] C:\WINDOWS\system32\ipjm.exe
O4 - HKLM\..\RunOnce: [netzd.exe] C:\WINDOWS\system32\netzd.exe
O4 - HKLM\..\RunOnce: [msah.exe] C:\WINDOWS\system32\msah.exe
O4 - HKLM\..\RunOnce: [ipno.exe] C:\WINDOWS\system32\ipno.exe
O4 - HKCU\..\Run: [Instant Access] rundll32.exe p2esocks_1014.dll,InstantAccess
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SysInit] wininit32.exe -drivers
O4 - HKCU\..\Run: [msadvapi32] msadvapi.exe
O4 - HKCU\..\Run: [warez] "C:\Program Files\Warez P2P Client\warez.exe" -h
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: USB Multimedia keyboard driver.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

Logged

 
SLIKK
Jr. Member
**

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 11


Bookmark and Share

View Profile
« Reply #2 on: July 21, 2004, 05:24:44 AM »

these ones look like they could be part of the problem
O4 - HKLM\..\RunOnce: [mfcyn.exe] C:\WINDOWS\mfcyn.exe
O4 - HKLM\..\RunOnce: [ipjm.exe] C:\WINDOWS\system32\ipjm.exe
O4 - HKLM\..\RunOnce: [netzd.exe] C:\WINDOWS\system32\netzd.exe
O4 - HKLM\..\RunOnce: [msah.exe] C:\WINDOWS\system32\msah.exe
O4 - HKLM\..\RunOnce: [ipno.exe] C:\WINDOWS\system32\ipno.exe

O4 - HKLM\..\Run: [aeilwadpi] C:\WINDOWS\System32\pinjgx.exe
O4 - HKLM\..\Run: [ogonuil] C:\WINDOWS\System32\ogonuil.exe
O4 - HKLM\..\Run: [sfsipca] C:\WINDOWS\System32\sfsipca.exe
Logged

 
Pages: [1] Go Up Print 
 
Jump to:  

Powered by MySQL Powered by PHP

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines

Valid XHTML 1.0! Valid CSS!

Disclaimer
This site is NOT responsible for any damage that the information on this site may cause to your system. Everything you try, whether inspired by the response given from this site or not, is entirely at your own risk. All product names and company names used herein are for identification purpose only and may be trademarks or registered trademarks of their respective owners. We are in no way affiliated or representing any of the companies on this site unless specified.
Back to Top
Stop Spam Harvesters, Join Project Honey Pot Fight Back Against Spammers! Get Firefox! Get Thunderbird! View Sylvain Amyots profile on LinkedIn
Back to Top
Google visited last this page June 14, 2019, 04:51:02 AM