MyTechSupport.ca :: Your Computer Technical Resource Headquarters! MyTechSupport.ca :: Your Computer Technical Resource Headquarters!
HOME FORUMS RESOURCES & TOOLS ARTICLES ONLINE STORE ABOUT US
Computer Support Forums arrow Internet & Network Support arrow Security & Viruses arrow Topic: New Hijack - Please Help ^^
November 13, 2019, 09:20:36 PM
 

Home Forum Rules Help Search Mobile Version Login Register

Welcome, Guest. Please login or register.
Did you miss your activation email?
November 13, 2019, 09:20:36 PM

Login with username, password and session length
 Featured Sites:
News
New  We now offer MyTechSupport.ca Merchandise! Every purchase goes towards maintaining our site.
Thank you for supporting MyTechSupport.ca!
  0 Members and 1 Guest are viewing this topic.
Pages: [1] Go Down Print
Author Topic: New Hijack - Please Help ^^  (Read 779 times)
GodFather
Newbie
*

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 2


Bookmark and Share

View Profile
« on: January 14, 2005, 12:49:13 AM »

Hi, it's my 1st post and i'm Italian...so please forgive me if makin' mistakes ^^.
Ok then...I'm using WinXP Pro and there are a lot of strange things in my PC...
1)I have 2 icons on the desktop (names are "Casino Online" and "Poker") and if I right click - on them I can delete them (only the "Delete" command appears);
2)There's a new Toolbar in Internet Explorer (IE) with the "Search" Field on the left, and  - others topics on the right;
3)If I open the Task Manager, I see 2 instances of IE opened (even if I don't have it
- opened) and if I try to close one of theese instances then it will run up again (using
- more much memory every time), so I can't close IE (when i start my internet connection,
- then those instances uses less mem);
4)When I close IE a program run for a moment and then IE return there, that program is in
- "C:\Documents and Settings\All Users\Dati Applicazioni\open grid dart mpeg\filename.exe"
- (sorry, but i have Italian version)...
- there is another file in the same dir named "mode bugs plus"...it's hidden, and "IN USE"
- and the programs can't find it (saying "The file is missing,or the path is incorrect"),
- but the file is there!!!
5)I tried to delete that directory in DOS mode and I made it...but when I entered Win XP,
- that damned files were still there (the .exe file name was changed instead of the hidden
- one) and the problems were the same of the 1,2,3,4 Points... Cool  
------------------------------------------------------------------------------------------
                                HEEEEEELLLLLLLLPPPPPPPPP
This problem is like that one "NEW HOST HIJACK INFECTION" (http://www.mytechsupport.ca/index.php?option=com_smf&Itemid=42&topic=6381) Sticked Post (Maybe it's the same).
I sent this post just for write "what this hijack do" and not for spam with a double topic...
Please Answer Soon, A sicilian guy ^^
« Last Edit: January 14, 2005, 01:24:00 AM by GodFather » Logged

 
Pancake
Global Moderator
Hero Member
*****

Karma: +78/-0
Offline Offline

Gender: Male
Posts: 3915


Bookmark and Share

View Profile
« Reply #1 on: January 14, 2005, 02:04:39 AM »

Please download HijackThis http://www.greyknight17.com/spy/HijackThis.exe.  Create a folder at C:\HJT and move HijackThis.exe there.  Run a scan and save the log file.  Post the whole log file here.  Do not fix anything since most of them listed there are harmless (some are system required).  This program will help us determine if there is any spyware/malware on your computer.
Logged

An Australian Member of

EDDY
GodFather
Newbie
*

Karma: +0/-0
Offline Offline

Gender: Male
Posts: 2


Bookmark and Share

View Profile
« Reply #2 on: January 14, 2005, 10:33:47 AM »

Thank a lot ^^ this is the LOG file:
Logfile of HijackThis v1.99.0
Scan saved at 11.33.44, on 14/01/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Software Bluetooth\bin\btwdins.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\System32\rundll32.exe
C:\Programmi\Java\j2re1.4.2_06\bin\jusched.exe
C:\Programmi\MSN Messenger\msnmsgr.exe
C:\Programmi\TweakRAM\_TweakRAM.exe
C:\Programmi\ZoneAlarm\zapro.exe
c:\progra~1\intern~1\iexplore.exe
C:\Programmi\Microsoft AntiSpyware\gcasDtServ.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Programmi\KijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.kypaxcglorzvddgfhsp.com/CBLfUlDIwQ1vazaVo2_sOU05aT4EKwH1IXGXqcokBCkhFvxnWbfm6LnOIKtvhOq9.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Programmi\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKCU\..\Run: [TweakRAM] C:\Programmi\TweakRAM\TweakRAM.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmi\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [EXIT DUMB] C:\DOCUME~1\FRANCE~1\DATIAP~1\MAILSE~1\bird draw 2.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Programmi\ZoneAlarm\zapro.exe
O8 - Extra context menu item: Invia a &Bluetooth - C:\Programmi\Software Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\Software Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programmi\Software Bluetooth\btsendto_ie.htm
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097515236734
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{844A7565-0A23-4A6A-AEFF-E14D6176005E}: NameServer = 217.141.250.206 151.99.125.1
O23 - Service: Bluetooth Service - WIDCOMM, Inc. - C:\Programmi\Software Bluetooth\bin\btwdins.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZONELABS\vsmon.exe

Logged

 
Pages: [1] Go Up Print 
 
Jump to:  

Powered by MySQL Powered by PHP

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines

Valid XHTML 1.0! Valid CSS!

Disclaimer
This site is NOT responsible for any damage that the information on this site may cause to your system. Everything you try, whether inspired by the response given from this site or not, is entirely at your own risk. All product names and company names used herein are for identification purpose only and may be trademarks or registered trademarks of their respective owners. We are in no way affiliated or representing any of the companies on this site unless specified.
Back to Top
Stop Spam Harvesters, Join Project Honey Pot Fight Back Against Spammers! Get Firefox! Get Thunderbird! View Sylvain Amyots profile on LinkedIn
Back to Top
Google visited last this page September 06, 2017, 11:19:39 PM