Help2Go
Free Computer Help.
Powered by Volunteers.




Home

These forums have moved!

Click here to view the new, updated Help2Go

Suspicious entries found, security check


   Help2Go Forum Index -> Spyware Help
View previous topic :: View next topic  
Author Message
PowerUser
Member


Joined: 17 Apr 2008
Posts: 4
Points: 0

blank.gif
Posted: Thu 04/17/2008 6:18pm [Post #1]

Hello,

i am posting here because your Help2Go Detective detected some suspicious entries in HijackThis log file and suggested further analyze on forums. Because it didnt show them, i used HijackThis.de website and it showed me 4 of them. Dont be mad at me for using other website, because your detective is better and it showed me 3 malicious things while hijackthis.de didnt detect any of them.

http://shrani.si/?23/N/9MundLU/hijackthisde.png 4 of them listed

To be honest i DO NOT have any problem at all, this is just security check, so please forgive me for bothering you here Sad

I kinda feel stupid, because you guys are volunteers and i am bothering you here, but i think you only have to look on 4-5 entries, nothing more, so if you are not to busy, please look at it.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 0:49:43, on 18.4.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20772)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\RunOnce: [WMC_0] C:\WINDOWS\system32\cmd.exe /c """""C:\WINDOWS\inf\unregmp2.exe"" /ShowWMP"""
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.htm l
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: I&zvoz v Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Raziskovanje - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15030/CTPID. cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XI\RpcSandraSrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 7624 bytes



Thanks.
 
This post has: 0 recommendations

Back to top
Canuck
Help2Go Administrator


Joined: 22 May 2003
Posts: 6945
Points: 1425
Location: Edmonton, Alberta, Canada

canada.gif
Posted: Thu 04/17/2008 6:35pm [Post #2]

We at Help2Go, along with other similar computer help forums, have a great need for expert HJT and spyware helpers. In other words, we're short handed. I am not an expert, but if you wish to try the following and then run your log through the detective again this may help.

I think the Detective was questioning some of the 04 entries in your log. Please do not change these through HJT as I do not know the HJT procedures. Instead, go to Start > Run > type in msconfig > OK > Startup tab > in the 'Startup Item' column you'll see boxes with check marks in them, these programs are running in the background and using up your RAM and slowing you down. In my opinion, you really only need your anti virus, firewall,and maybe one or two other programs running. Start at the top, do a search in google of that item and look up the process information on each item. It should tell you if the program is needed or not, however it goes a little deeper than that. For example, it will probably say that a graphic card (ATI etc) is needed, but in fact, unless you're a heavy game player and need to adjust your monitor settings all the time, it's not needed at all .. you'd uncheck the box. As I say, go through the list and figure out what you really need. Remember, when stopping these processes running, you are not uninstalling these programs, they can easily be activated by going through Start > All Programs or through a shortcut on your desktop. Also. at any time you can go back into msconfig and check the program again if you feel it needs to be running.

After unchecking the boxes, >OK and then reboot your PC. When rebooted, a configuration window will open, check the box 'do not show this message again' or words to this effect > OK and your done. From this point, you should see an improvement in boot up time as well as a general increase in PC speed.

If you have any questions in regards to some of the running background programs, give us the Startup Item (in list form) and we'll give you our advice.

Hope this helps.
 
This post has: 0 recommendations

Back to top
PowerUser
Member


Joined: 17 Apr 2008
Posts: 4
Points: 0

blank.gif
Posted: Fri 04/18/2008 7:48am [Post #3]

Thanks for really quick response, however i already knew this about msconfig and reduced my programs to 8.

I was able to find answers to everything except this process :

" CTFMON.exe " when i try to find information about it, users and websites are kinda separated between :

a) terminate it with no harm
b) should not be terminated

It would be lovely knowing once and for all if it can be terminated or no, but otherwise i dont want to take your time. Wink

I was only interested in : if those 4 entries in HJT ARE malicious or not.

Thanks again.
 
This post has: 0 recommendations

Back to top
Osc
Help2Go Administrator


Joined: 01 Jan 1999
Posts: 1789
Points: 516
Location: Washington, DC

usa.gif
Posted: Fri 04/18/2008 9:46am [Post #4]

Hi,

We made some updates to the Detective, including checking for CTFMON - try running your log through again and see if it comes out clean.

Osc

_________________
Oscar Sodani
Help2Go Administrator
 
This post has: 1 recommendation

Back to top
PowerUser
Member


Joined: 17 Apr 2008
Posts: 4
Points: 0

blank.gif
Posted: Fri 04/18/2008 1:28pm [Post #5]

Yes, now it does come out clean and it no longer says that suspicious files have been found.

I suppose that this means that my log file is perfectly clean?
 
This post has: 0 recommendations

Back to top
Canuck
Help2Go Administrator


Joined: 22 May 2003
Posts: 6945
Points: 1425
Location: Edmonton, Alberta, Canada

canada.gif
Posted: Fri 04/18/2008 1:34pm [Post #6]

Without a spyware fighter to confirm you're clean we can't say you are 100%, but if the detective hasn't found any more, and your anti virus program says clean, I'd say chances are pretty good that you're OK.
 
This post has: 1 recommendation

Back to top
PowerUser
Member


Joined: 17 Apr 2008
Posts: 4
Points: 0

blank.gif
Posted: Sat 04/19/2008 8:12am [Post #7]

Thanks a lot guys, my doubts are now cleared.

thx for all the help
 
This post has: 0 recommendations

Back to top
Display posts from previous:   
   Help2Go Forum Index -> Spyware Help All times are GMT - 5 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


phpBB component by Adam van Dongen. Based on phpBB © 2001, 2002 phpBB Group
Creative Commons License

(C) 2008 Help2Go      Contact Us      Joomla! is Free Software released under the GNU/GPL License.