My HJT Log
| Author |
Message |
Jsyn
Joined: 13 May 2006
Posts: 19
|
 Post subject: My HJT Log |
 |
|
My HJT Log |
|
Sun May 28, 2006 1:22 am
 |
|
 |
Jsyn
Joined: 13 May 2006
Posts: 19
|
| Post subject: |
|
|
Logfile of HijackThis v1.99.1
Scan saved at 11:16:01, on 2006-5-28
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\csrss.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
C:\Program Files\Common Files\COMM\Network.exe
C:\WINDOWS\win32host.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\winscntrl.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\mssvcc.exe
C:\WINDOWS\System32\lup.exe
C:\WINDOWS\System32\pjidtm.exe
C:\WINDOWS\System32\win32bootcfg.exe
C:\iexplorer.exe
C:\defender21.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Administrator\桌�\HijackThis.exe
O2 - BHO: QQIEHelper - {54EBD53A-9BC1-480B-966A-843A333CA162} - D:\伟烈\qq\QQIEHelper.dll
O2 - BHO: (no name) - {F2FA09FB-EE7A-46d8-9145-A1EEF7850052} - C:\WINDOWS\System32\jkkhg.dll
O3 - Toolbar: 电�(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [msconfig38] mssvcc.exe
O4 - HKLM\..\Run: [secures23] lup.exe
O4 - HKLM\..\Run: [WINDOWS] C:\WINDOWS\System32\pjidtm.exe
O4 - HKLM\..\Run: [Windows Core Kernel Update] C:\WINDOWS\System32\win32bootcfg.exe
O4 - HKLM\..\Run: [Services] C:\iexplorer.exe
O4 - HKLM\..\Run: [newname] C:\\newname21.exe
O4 - HKLM\..\Run: [defender] C:\\defender21.exe
O4 - HKLM\..\Run: [keyboard] C:\\keyboard21.exe
O4 - HKLM\..\Run: [flpwin] rundll32.exe C:\WINDOWS\System32\flpwin.dll,start
O4 - HKLM\..\RunServices: [msconfig38] mssvcc.exe
O4 - HKLM\..\RunServices: [secures23] lup.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: ä¸Šä¼ åˆ°QQ网络硬盘 - D:\伟烈\qq\AddToNetDisk.htm
O8 - Extra context menu item: æ·»åŠ åˆ°QQ自定义é?¢æ?¿ - D:\伟烈\qq\AddPanel.htm
O8 - Extra context menu item: æ·»åŠ åˆ°QQ表情 - D:\伟烈\qq\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信��该图片 - D:\伟烈\qq\SendMMS.htm
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
O9 - Extra button: 寻��趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file missing)
O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\伟烈\qq\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\伟烈\qq\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\伟烈\qq\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具�设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\伟烈\qq\QQIEHelper.dll
O9 - Extra button: 情景�天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra 'Tools' menuitem: 修��览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O9 - Extra 'Tools' menuitem: 清�上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O11 - Options group: [!CNS] 网络实å??
O20 - Winlogon Notify: jkkhg - C:\WINDOWS\SYSTEM32\jkkhg.dll
O23 - Service: Windows Service Manager (csrss) - Unknown owner - C:\WINDOWS\csrss.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: MD Simple Burner Service (NetMDSB) - Sony Corporation - C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Network System (Universal Disk Manager) - COMENET TECHNOLOGY - C:\Program Files\Common Files\COMM\Network.exe
O23 - Service: Win32 Kernel Update (Win32Kernel) - Unknown owner - C:\WINDOWS\win32host.exe |
|
Sun May 28, 2006 1:22 am
|
|
|
HJT Analyzer
Joined: 15 Mar 2006
Posts: 638
|
| Post subject: My HijackThis log |
|
|
Hello, visitor!
The Hijack This log analyzer has analyzed your log. Please take a closer look on the results.
Your log does not indicate any spyware or virus infection. However, there are some entries that you might want to fix. Please follow the steps below.
The following entries are not malicious, but some of them are not used anymore. You may use HijackThis to fix a few of them. However, please keep in mind that some of the entries marked as Questionable or Not Needed are fully legitimate and might be required by installed software to work properly, while some others might be related to certain parasites. It is up to you to decide whether you need any of them, or not.
C:\WINDOWS\csrss.exe
C:\iexplorer.exe
O4 - HKLM\..\Run: [Services] C:\iexplorer.exe
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
O9 - Extra button: 寻��趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file missing)
O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\伟烈\qq\QQ.EXE
O9 - Extra ''Tools'' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\伟烈\qq\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\伟烈\qq\QQIEHelper.dll
O9 - Extra ''Tools'' menuitem: QQ炫彩工具�设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\伟烈\qq\QQIEHelper.dll
O9 - Extra button: 情景�天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra ''Tools'' menuitem: 修��览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O9 - Extra ''Tools'' menuitem: 清�上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O11 - Options group: [!CNS] 网络实å??
O23 - Service: Windows Service Manager (csrss) - Unknown owner - C:\WINDOWS\csrss.exe
The following files and Windows registry entries are marked as "unknown". Currently, the HijackThis Log Analyzer cannot provide required information on these items. The files and entries in the list below can be both malicious and fully legitimate. Because of this, please do not take any action! Wait for the forum responders or other forum users to provide you with necessary details and further instructions.
C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe
C:\Program Files\Common Files\COMM\Network.exe
C:\WINDOWS\win32host.exe
C:\WINDOWS\system32\winscntrl.exe
C:\WINDOWS\System32\mssvcc.exe
C:\WINDOWS\System32\lup.exe
C:\WINDOWS\System32\pjidtm.exe
C:\WINDOWS\System32\win32bootcfg.exe
C:\defender21.exe
O2 - BHO: (no name) - {F2FA09FB-EE7A-46d8-9145-A1EEF7850052} - C:\WINDOWS\System32\jkkhg.dll
O4 - HKLM\..\Run: [msconfig38] mssvcc.exe
O4 - HKLM\..\Run: [secures23] lup.exe
O4 - HKLM\..\Run: [WINDOWS] C:\WINDOWS\System32\pjidtm.exe
O4 - HKLM\..\Run: [Windows Core Kernel Update] C:\WINDOWS\System32\win32bootcfg.exe
O4 - HKLM\..\Run: [newname] C:\\newname21.exe
O4 - HKLM\..\Run: [defender] C:\\defender21.exe
O4 - HKLM\..\Run: [keyboard] C:\\keyboard21.exe
O4 - HKLM\..\RunServices: [msconfig38] mssvcc.exe
O4 - HKLM\..\RunServices: [secures23] lup.exe
O20 - Winlogon Notify: jkkhg - C:\WINDOWS\SYSTEM32\jkkhg.dll
O23 - Service: Network System (Universal Disk Manager) - COMENET TECHNOLOGY - C:\Program Files\Common Files\COMM\Network.exe
O23 - Service: Win32 Kernel Update (Win32Kernel) - Unknown owner - C:\WINDOWS\win32host.exe
If you want to see more detailed analysis of your log, click here.
Thank you for using the 2-Spyware.com HijackThis log analyzer beta 1! |
|
Sun May 28, 2006 1:23 am
|
|
|
GTO
Joined: 15 Nov 2005
Posts: 1519
|
| Post subject: |
|
|
Hi, Jsyn. Sorry for the delay. 
Please follow these steps:
1. Download a variant of the VundoFix tool. Then double-click on the downloaded file. This will unpack VundoFix files.
2. Download Pocket KillBox or KillBox utility.
3. Use HijackThis to fix the following entries:
O4 - HKLM\..\Run: [msconfig38] mssvcc.exe
O4 - HKLM\..\Run: [secures23] lup.exe
O4 - HKLM\..\Run: [WINDOWS] C:\WINDOWS\System32\pjidtm.exe
O4 - HKLM\..\Run: [Windows Core Kernel Update] C:\WINDOWS\System32\win32bootcfg.exe
O4 - HKLM\..\Run: [Services] C:\iexplorer.exe
O4 - HKLM\..\Run: [newname] C:\\newname21.exe
O4 - HKLM\..\Run: [defender] C:\\defender21.exe
O4 - HKLM\..\Run: [keyboard] C:\\keyboard21.exe
O4 - HKLM\..\Run: [flpwin] rundll32.exe C:\WINDOWS\System32\flpwin.dll,start
O4 - HKLM\..\RunServices: [msconfig38] mssvcc.exe
O4 - HKLM\..\RunServices: [secures23] lup.exe
O9 - Extra button: Yahoo 1G电邮 - {507F9113-CD77-4866-BA92-0E86DA3D0B97} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomail (file missing)
O9 - Extra button: 寻��趣多 - {59BC54A2-56B3-44a0-93E5-432D58746E26} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=taobao (file missing)
O9 - Extra button: 雅虎助手 - {5D73EE86-05F1-49ed-B850-E423120EC338} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yassist (file missing)
O9 - Extra button: 情景�天 - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=yahoomsg (file missing)
O9 - Extra button: (no name) - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra 'Tools' menuitem: 修��览器 - {ECF2E268-F28C-48d2-9AB7-8F69C11CCB71} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=repair (file missing)
O9 - Extra button: (no name) - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O9 - Extra 'Tools' menuitem: 清�上网记录 - {FD00D911-7529-4084-9946-A29F1BDF4FE5} - http://cn.zs.yahoo.com/cnsbutton.htm?source=cns&btn=clean (file missing)
O11 - Options group: [!CNS] 网络实å??
O23 - Service: Win32 Kernel Update (Win32Kernel) - Unknown owner - C:\WINDOWS\win32host.exe
4. Now restart your system in Safe Mode. This step is very important!
5. Once in Safe Mode, use either Pocket KillBox or KillBox to delete the following files:
C:\WINDOWS\win32host.exe
C:\WINDOWS\system32\winscntrl.exe
C:\WINDOWS\System32\mssvcc.exe
C:\WINDOWS\System32\lup.exe
C:\WINDOWS\System32\pjidtm.exe
C:\WINDOWS\System32\win32bootcfg.exe
C:\WINDOWS\System32\flpwin.dll
C:\iexplorer.exe
C:\defender21.exe
C:\newname21.exe
C:\keyboard21.exe
6. Then open the VundoFix folder and execute the KillVundo.bat file.
* You will be presented with a warning. At this point press enter.
* Then you will be asked to type in the filepath as instructed by the forum staff.
At this point type in this: C:\WINDOWS\system32\jkkhg.dll. Press enter, then the F6 key.
* Now you should be asked to type in the second path as instructed by the forum staff.
At this point type in this: C:\WINDOWS\system32\ghkkj.*. Press enter, then the F6 key. Press enter one more time. Now the fix should run.
7. Then VundoFix should launch the HijackThis program. If it does not open automatically, please run it manually. Use HijackThis to fix the following entries:
O2 - BHO: (no name) - {F2FA09FB-EE7A-46d8-9145-A1EEF7850052} - C:\WINDOWS\System32\jkkhg.dll
O20 - Winlogon Notify: jkkhg - C:\WINDOWS\SYSTEM32\jkkhg.dll
8. After you get done, restart your computer, run new HijackThis scan and post a fresh log here.
P.S. Your system is not up-to-date! You have to install Service Pack 2 for Microsoft Windows XP and Service Pack 2 for Microsoft Internet Explorer. Also apply all latest updates and security fixes. |
|
Fri Jun 02, 2006 6:10 am
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
|
|
|
Recommended software:
Spyware Doctor
 (91/100)
Spyware Doctor is a very powerful, but yet highly user-friendly spyware remover, made by PC Tools, reputable computer security experts. This product provides effective and easy-to-manage...
SUPERAntiSpyware
 (89/100)
SUPERAntiSpyware is a powerful, highly effective spyware remover introducing advanced parasite detection and removal features along with reliable real-time protection. The program is not...
CounterSpy
 (85/100)
CounterSpy is a powerful spyware remover based on revolutionary hybrid engine, which incorporates traditional anti-spyware and advanced antivirus engines. Such combination allows CounterSpy...
Malwarebytes Anti Malware
 (75/100)
There are loads of malware removers on the net today and most of them are lightweight applications, which usually means they’re fast and don’t have many features. One such...
Windows Defender
(75/100)
Windows Defender is a free anti-spyware program made by the leading software company to add native spyware protection to its most popular product - the Microsoft Windows operating...
Encyclopedia of parasites:
|
