please analyse this log for me please , thank you very much

shawnlvdevine99 · Joined: 04 Jul 2007 Posts: 1

Logfile of HijackThis v1.99.1
Scan saved at 12:21:46 AM, on 7/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.e...
C:\WINDOWS\system32\services.e...
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.ex...
C:\WINDOWS\system32\svchost.ex...
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\TPSrv.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\AVENGINE.EXE
c:\program files\panda software\panda antivirus + firewall 2007\firewall\PNMSRV.EXE
C:\WINDOWS\system32\spoolsv.ex...
C:\WINDOWS\system32\j5241134.e...
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\WINDOWS\system32\PSIService...
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PsImSvc.exe
C:\WINDOWS\System32\svchost.ex...
C:\PROGRA~1\SPEEDB~1\VideoAcce...
C:\Program Files\AlienGUIse\wbload.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\jre1.6.0_01\bin\jus...
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Logitech\Video\LogiTray....
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\LVComsX.ex...
C:\Program Files\Logitech\Video\FxSvr2.ex...
C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe
C:\PROGRA~1\SPEEDB~1\VideoAcce...
C:\Documents and Settings\mark\Local Settings\Application Data\svchost.exe
C:\WINDOWS\system32\wscntfy.ex...
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\mark\Desktop\HijackTh...

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-00902... - C:\Program Files\Yahoo!\Companion\Install...
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49... - (no file)
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695E... - C:\Program Files\Yahoo!\Companion\Install...
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5... - (no file)
O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420... - C:\WINDOWS\system32\tmp73.tmp....
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7... - C:\PROGRA~1\SPYBOT~1\SDHelper....
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0D... - C:\Program Files\Yahoo!\Common\yiesrvc.dl...
O2 - BHO: (no name) - {726d8921-9e51-4002-a343-984d4... - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF... - C:\Program Files\Java\jre1.6.0_01\bin\ssv...
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-00902... - C:\Program Files\Yahoo!\Companion\Install...
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49... - (no file)
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.e...
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jus...
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EX...
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.e...
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray....
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MShelp1] "C:\Program Files\MSN Messenger\svchost.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\APVXDWIN.EXE" /s
O4 - HKLM\..\RunServices: [TPSRV9x] "C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\TPSrv.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestE... boot
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe" autostart
O4 - Startup: Alienware Dock.lnk = C:\Program Files\AlienGUIse\AlienwareDock...
O4 - Global Startup: PalStart.lnk = C:\Program Files\Paltalk Messenger\palstart.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401... - C:\Program Files\Java\jre1.6.0_01\bin\ssv...
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401... - C:\Program Files\Java\jre1.6.0_01\bin\ssv...
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49... - C:\Program Files\Paltalk Messenger\Paltalk.exe
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0D... - C:\Program Files\Yahoo!\Common\yiesrvc.dl...
O16 - DPF: {17492023-C23A-453E-A040-C7C58... (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=3...
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4... (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelpe...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA... (MUWebControl Class) - http://update.microsoft.com/microsoftupd...
O20 - AppInit_DLLs: c:\windows\system32\geebxut.dl...
O20 - Winlogon Notify: atkdsg - atkdsg.dll (file missing)
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O20 - Winlogon Notify: cherry - cherry.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dl...
O20 - Winlogon Notify: kbdspi - kbdspi.dll (file missing)
O20 - Winlogon Notify: mljgg - C:\WINDOWS\system32\mljgg.dll (file missing)
O20 - Winlogon Notify: WB - C:\Program Files\AlienGUIse\fastload.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.d...
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D52... - C:\WINDOWS\system32\WPDShServi...
O23 - Service: dns cache reader (DNSCacheReader) - Unknown owner - C:\WINDOWS\system32\j5241134.e...
O23 - Service: DomainService - Unknown owner - C:\Documents and Settings\mark\Application Data\tmpC0.tmp.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\pavsrv51.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software International - c:\program files\panda software\panda antivirus + firewall 2007\firewall\PNMSRV.EXE
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService...
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PsImSvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\TPSrv.exe
O23 - Service: VideoAcceleratorEngine - Speedbit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcce...

Additional Details

7 hours ago
which ones are virus , or worms or which files are no good , so i can ask hijack this to delete them for me thank

HJT Analyzer · Joined: 15 Mar 2006 Posts: 623

Hello, visitor!

The Hijack This log analyzer has analyzed your log. Please take a closer look on the results.

Your system seems to be infected with malicious parasites. Please follow the steps below in order to eliminate the infection and clean up your computer.

1. Download the Pocket KillBox utility. You will need it later to delete parasite-related files and folders.
2. Use HijackThis to fix the following entries:

O4 - Global Startup: PalStart.lnk = C:\Program Files\Paltalk Messenger\palstart.exe

3. The following entries are not malicious, but some of them are not used anymore. You may use HijackThis to fix a few of them. However, please keep in mind that some of the entries marked as Questionable or Not Needed are fully legitimate and might be required by installed software to work properly, while some others might be related to certain parasites. It is up to you to decide whether you need any of them, or not.
C:\Documents and Settings\mark\Local Settings\Application Data\svchost.exe
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-00902... - C:\Program Files\Yahoo!\Companion\Install...
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49... - (no file)
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5... - (no file)
O2 - BHO: (no name) - {726d8921-9e51-4002-a343-984d4... - (no file)
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49... - (no file)
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.e...
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EX...
O4 - HKLM\..\Run: [MShelp1] "C:\Program Files\MSN Messenger\svchost.exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401... - C:\Program Files\Java\jre1.6.0_01\bin\ssv...
O9 - Extra ''Tools'' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401... - C:\Program Files\Java\jre1.6.0_01\bin\ssv...
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49... - C:\Program Files\Paltalk Messenger\Paltalk.exe
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0D... - C:\Program Files\Yahoo!\Common\yiesrvc.dl...
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4... (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelpe...
O20 - Winlogon Notify: atkdsg - atkdsg.dll (file missing)
O20 - Winlogon Notify: cherry - cherry.dll (file missing)
O20 - Winlogon Notify: kbdspi - kbdspi.dll (file missing)
O20 - Winlogon Notify: mljgg - C:\WINDOWS\system32\mljgg.dll (file missing)
O23 - Service: DomainService - Unknown owner - C:\Documents and Settings\mark\Application Data\tmpC0.tmp.exe (file missing)
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PsImSvc.exe

4. Now restart your system in Safe Mode. This step is very important!
5. Use the Pocket KillBox utility to delete the following files:

C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\PsImSvc.exe
C:\Program Files\Paltalk Messenger\palstart.exe

The following files and Windows registry entries are marked as "unknown". Currently, the HijackThis Log Analyzer cannot provide required information on these items. The files and entries in the list below can be both malicious and fully legitimate. Because of this, please do not take any action! Wait for the forum responders or other forum users to provide you with necessary details and further instructions.
C:\WINDOWS\SYSTEM32\winlogon.e...
C:\WINDOWS\system32\services.e...
C:\WINDOWS\system32\svchost.ex...
C:\WINDOWS\system32\svchost.ex...
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\TPSrv.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\pavsrv51.exe
c:\program files\panda software\panda antivirus + firewall 2007\firewall\PNMSRV.EXE
C:\WINDOWS\system32\spoolsv.ex...
C:\WINDOWS\system32\j5241134.e...
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\WINDOWS\system32\PSIService...
C:\WINDOWS\System32\svchost.ex...
C:\PROGRA~1\SPEEDB~1\VideoAcce...
C:\Program Files\Java\jre1.6.0_01\bin\jus...
C:\Program Files\Logitech\Video\LogiTray....
C:\WINDOWS\system32\LVComsX.ex...
C:\Program Files\Logitech\Video\FxSvr2.ex...
C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe
C:\PROGRA~1\SPEEDB~1\VideoAcce...
C:\WINDOWS\system32\wscntfy.ex...
C:\Documents and Settings\mark\Desktop\HijackTh...
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695E... - C:\Program Files\Yahoo!\Companion\Install...
O2 - BHO: (no name) - {1F6581D5-AA53-4b73-A6F9-41420... - C:\WINDOWS\system32\tmp73.tmp....
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7... - C:\PROGRA~1\SPYBOT~1\SDHelper....
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0D... - C:\Program Files\Yahoo!\Common\yiesrvc.dl...
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF... - C:\Program Files\Java\jre1.6.0_01\bin\ssv...
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-00902... - C:\Program Files\Yahoo!\Companion\Install...
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jus...
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.e...
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray....
O4 - HKLM\..\RunServices: [TPSRV9x] "C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\TPSrv.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestE... boot
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2007\MemOptimizer.exe" autostart
O4 - Startup: Alienware Dock.lnk = C:\Program Files\AlienGUIse\AlienwareDock...
O20 - AppInit_DLLs: c:\windows\system32\geebxut.dl...
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dl...
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.d...
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D52... - C:\WINDOWS\system32\WPDShServi...
O23 - Service: dns cache reader (DNSCacheReader) - Unknown owner - C:\WINDOWS\system32\j5241134.e...
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software International - c:\program files\panda software\panda antivirus + firewall 2007\firewall\PNMSRV.EXE
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService...
O23 - Service: VideoAcceleratorEngine - Speedbit Ltd. - C:\PROGRA~1\SPEEDB~1\VideoAcce...
After going through all the steps, run another HijackThis scan and post a fresh log to the HijackThis analyzer. It is possible that some parasites your system was infected with were not removed completely and may restore themselves later.

If you want to see more detailed analysis of your log, click here.

Thank you for using the 2-Spyware.com HijackThis log analyzer!