+ Reply to Thread
Results 1 to 2 of 2

Thread: hijack log

  1. 01-10-2010 03:59 AM #1
    raju50
    raju50 is offline
    Member
    Join Date
    Jan 2010
    Posts
    1
    Points
    0

    Default hijack log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 3:20:59 PM, on 1/10/2010
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\SYSTEM32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\WLTRYSVC.EXE
    C:\WINDOWS\System32\bcmwltry.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\QUICKH~1\QUICKH~3\acs.exe
    C:\PROGRA~1\QUICKH~1\QUICKH~2\SAPISSVC.EXE
    C:\Program Files\iolo\common\lib\ioloServiceManager.exe
    C:\Program Files\iolo\System Mechanic\IoloSGCtrl.exe
    C:\Program Files\IObit\IObit Security 360\IS360srv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
    C:\PROGRA~1\QUICKH~1\QUICKH~2\opssvc.exe
    C:\PROGRA~1\QUICKH~1\QUICKH~2\quhlpsvc.exe
    C:\Tally\tallylicserver.exe
    C:\Tally\Tally9.exe
    C:\TallyLicenseServer\tallylicserver.exe
    C:\Program Files\Netbooster Client\Client\ventc.exe
    C:\Program Files\Netbooster Client\squid\ventcsquid.exe
    C:\Program Files\Netbooster Client\squid\ventcdnsserver.exe
    C:\Program Files\Netbooster Client\squid\ventcdnsserver.exe
    C:\Program Files\Netbooster Client\squid\ventcdnsserver.exe
    C:\Program Files\Netbooster Client\squid\ventcdnsserver.exe
    C:\Program Files\Netbooster Client\squid\ventcdnsserver.exe
    C:\Program Files\Netbooster Client\squid\ventcdnsserver.exe
    C:\Program Files\Netbooster Client\squid\ventcunlinkd.exe
    C:\WINDOWS\OEM13Mon.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\Quick Heal\Quick Heal Internet Security\EMLPROXY.EXE
    C:\Program Files\DellTPad\Apoint.exe
    C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe
    C:\Program Files\Netbooster Client\Configurator\ventcfg.exe
    C:\PROGRA~1\QUICKH~1\QUICKH~3\op_mon.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
    C:\PROGRA~1\QUICKH~1\QUICKH~2\onlinent.exe
    C:\PROGRA~1\QUICKH~1\QUICKH~2\UPSCHD.EXE
    C:\PROGRA~1\QUICKH~1\QUICKH~2\SCANMSG.EXE
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\Program Files\Cyberlink\Shared Files\brs.exe
    C:\Program Files\Everything\Everything.exe
    C:\Program Files\WordWeb\wweb32.exe
    C:\Program Files\DellTPad\ApMsgFwd.exe
    C:\Program Files\iolo\System Mechanic\SystemGuardAlerter.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\IObit\IObit Security 360\IS360tray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\DellTPad\HidFind.exe
    C:\Program Files\Desktop Icon Toy\DesktopIconToy.exe
    C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
    C:\Program Files\DellTPad\Apntex.exe
    C:\Program Files\Stardock\CursorFX\CursorFX.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
    C:\Program Files\TechSmith\Snagit 9\Snagit32.exe
    C:\Program Files\A-1 Wallpaper Pro 1.1\a-1pro.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
    C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    C:\Program Files\TechSmith\Snagit 9\TSCHelp.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
    C:\Program Files\TechSmith\Snagit 9\SnagPriv.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
    C:\Program Files\TechSmith\Snagit 9\snagiteditor.exe
    C:\Program Files\IObit\IObit Security 360\is360.exe
    C:\Program Files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe
    C:\PROGRA~1\QUICKH~1\QUICKH~2\Scanner.exe
    C:\Program Files\RELIANCE\LXU800\LXU800.exe
    C:\Program Files\Opera\opera.exe
    C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Ask.com Search Engine - Better Web Search
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\Snagit 9\SnagitBHO.dll
    O2 - BHO: CIEProtection - {02D6B6B3-5D97-4EDE-AAC1-4D0BE8FE9CD3} - C:\PROGRA~1\QUICKH~1\QUICKH~2\qhiepro.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: IE to GetRight Helper - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O2 - BHO: Anti Popup - {EFCA9D4B-F2E8-487d-8505-E4D0E459ABFE} - C:\PROGRA~1\QUICKH~1\QUICKH~2\apop.dll
    O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
    O3 - Toolbar: Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\Snagit 9\SnagitIEAddin.dll
    O4 - HKLM\..\Run: [OEM13Mon.exe] C:\WINDOWS\OEM13Mon.exe
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe
    O4 - HKLM\..\Run: [DELL Webcam Manager] "C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe" /s
    O4 - HKLM\..\Run: [Venturi Configurator] C:\Program Files\Netbooster Client\Configurator\ventcfg.exe -nomsgbox
    O4 - HKLM\..\Run: [Quick Heal Core UI] C:\PROGRA~1\QUICKH~1\QUICKH~2\strtupap.exe
    O4 - HKLM\..\Run: [Quick Heal Monitor] "C:\PROGRA~1\QUICKH~1\QUICKH~3\op_mon.exe" /tray /noservice
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
    O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
    O4 - HKLM\..\Run: [BDRegion] C:\Program Files\Cyberlink\Shared Files\brs.exe
    O4 - HKLM\..\Run: [Everything] "C:\Program Files\Everything\Everything.exe" -startup
    O4 - HKLM\..\Run: [WordWeb] "C:\Program Files\WordWeb\wweb32.exe" -startup
    O4 - HKLM\..\Run: [SystemGuardAlerter] "C:\Program Files\iolo\System Mechanic\SystemGuardAlerter.exe"
    O4 - HKLM\..\Run: [IObit Security 360] "C:\Program Files\IObit\IObit Security 360\IS360tray.exe" /autostart
    O4 - HKLM\..\RunOnce: [Startup Scan] C:\PROGRA~1\QUICKH~1\QUICKH~2\Sensor.EXE /check
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [DesktopIconToy] C:\Program Files\Desktop Icon Toy\DesktopIconToy.exe
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [CursorFX] "C:\Program Files\Stardock\CursorFX\CursorFX.exe"
    O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
    O4 - HKUS\S-1-5-21-350281380-233495102-1455855570-1003\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
    O4 - HKUS\S-1-5-21-350281380-233495102-1455855570-1003\..\Run: [DesktopIconToy] C:\Program Files\Desktop Icon Toy\DesktopIconToy.exe (User '?')
    O4 - HKUS\S-1-5-21-350281380-233495102-1455855570-1003\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" (User '?')
    O4 - HKUS\S-1-5-21-350281380-233495102-1455855570-1003\..\Run: [CursorFX] "C:\Program Files\Stardock\CursorFX\CursorFX.exe" (User '?')
    O4 - HKUS\S-1-5-21-350281380-233495102-1455855570-1003\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup (User '?')
    O4 - HKUS\S-1-5-21-350281380-233495102-1455855570-1005\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
    O4 - S-1-5-21-350281380-233495102-1455855570-1003 Startup: A-1 Wallpaper Pro.lnk = C:\Program Files\A-1 Wallpaper Pro 1.1\a-1pro.exe (User '?')
    O4 - S-1-5-21-350281380-233495102-1455855570-1003 Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (User '?')
    O4 - S-1-5-18 Startup: A-1 Wallpaper Pro.lnk = C:\Program Files\A-1 Wallpaper Pro 1.1\a-1pro.exe (User '?')
    O4 - S-1-5-18 Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (User '?')
    O4 - .DEFAULT Startup: A-1 Wallpaper Pro.lnk = C:\Program Files\A-1 Wallpaper Pro 1.1\a-1pro.exe (User 'Default user')
    O4 - .DEFAULT Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (User 'Default user')
    O4 - Startup: A-1 Wallpaper Pro.lnk = C:\Program Files\A-1 Wallpaper Pro 1.1\a-1pro.exe
    O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
    O4 - Global Startup: Bluetooth Manager.lnk = ?
    O4 - Global Startup: Snagit 9.lnk = C:\Program Files\TechSmith\Snagit 9\Snagit32.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O16 - DPF: {FFD85DC8-5261-4D11-B728-F7C59D911691} (iolo.ProductDetector) - https://secure.iolo.com/app/ocx/UpgradeVerify.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{3364D8E4-A9E8-4CCA-A850-6AFA0A8D2F33}: NameServer = 61.1.96.69,61.1.96.71
    O17 - HKLM\System\CCS\Services\Tcpip\..\{E145C1AD-E599-4ED7-8BCD-AF486560ED46}: NameServer = 202.138.97.193 202.138.96.2
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
    O20 - AppInit_DLLs: c:\progra~1\quickh~1\quickh~3\wl_hook.dll
    O23 - Service: Quick Heal Client Security Service (acssrv) - Quick Heal Technologies (P) Ltd. - C:\PROGRA~1\QUICKH~1\QUICKH~3\acs.exe
    O23 - Service: Cleaning Service - Unknown owner - C:\PROGRA~1\QUICKH~1\QUICKH~2\ntclnsrv.exe
    O23 - Service: Core Mail Protection - Quick Heal Technologies (P) Ltd. - C:\Program Files\Quick Heal\Quick Heal Internet Security\EMLPROXY.EXE
    O23 - Service: Core Scanning Server - Quick Heal Technologies (P) Ltd. - C:\PROGRA~1\QUICKH~1\QUICKH~2\SAPISSVC.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
    O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe
    O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - C:\Program Files\iolo\System Mechanic\IoloSGCtrl.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
    O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
    O23 - Service: Online Protection System - Quick Heal Technologies (P) Ltd. - C:\PROGRA~1\QUICKH~1\QUICKH~2\opssvc.exe
    O23 - Service: Quick Update Service - Quick Heal Technologies (P) Ltd. - C:\PROGRA~1\QUICKH~1\QUICKH~2\quhlpsvc.exe
    O23 - Service: Internet Security Helper Service WSC (ScanWscS) - Quick Heal Technologies (P) Ltd. - C:\Program Files\Quick Heal\Quick Heal Internet Security\scanwscs.exe
    O23 - Service: Tally License Server (NT) (Tally License Server) - Unknown owner - C:\Tally\tallylicserver.exe
    O23 - Service: Tally License Server 3.0 - Unknown owner - C:\TallyLicenseServer\tallylicserver.exe
    O23 - Service: Venturi Client (VenturiClient) - Venturi Wireless - C:\Program Files\Netbooster Client\Client\ventc.exe
    O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

    --
    End of file - 12702 bytes
    Reply With Quote Reply With Quote
  2. 01-10-2010 10:44 AM #2
    Canuck
    Canuck is offline
    Administrator Help2Go Administrator Canuck's Avatar
    Join Date
    May 2003
    Location
    Edmonton, Alberta, Canada
    Posts
    9,206
    Points
    1826

    Default

    A description of your problem would be appreciated, our experts are overextended at the moment, therefore your patience is appreciated. Unless you complete the steps given and give us the 3 logs required, your request will go unanswered.

    Please folks, we cannot help you with your computer unless you read this tutorial and follow the instructions    :

    How to Start Removing Viruses and Spyware from your Computer

     We receive many many questions every day, and as a volunteer service, we can only help those who are willing to help themselves.

    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »