What do I need to remove
Results 1 to 6 of 6

Thread: What do I need to remove

  1. #1
    Join Date
    Nov 1999
    Posts
    438

    What do I need to remove

    Please let me know what I need to remove from my log.

    I have ran all software as required prior to running Hijackthis. Someone has been looking at my emails which is password protected and printing them up until 6 months ago when I had a trojon which I removed using CWShredder and running all the other killers I have.

    I have running on my PC, etrust antivirus, spybot, spyblaster, CWShredder, adaware and Hijackthis.

    Logfile of HijackThis v1.97.7
    Scan saved at 2:24:10 PM, on 10/6/2004
    Platform: Windows ME (Win9x 4.90.3000)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
    C:\WINDOWS\SYSTEM\ZONELABS\MINILOG.EXE
    C:\WINDOWS\SYSTEM\STIMON.EXE
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\PROGRAM FILES\CA\ETRUST\ANTIVIRUS\INOTASK.EXE
    C:\PROGRAM FILES\CA\ETRUST\ANTIVIRUS\INORT9X.EXE
    C:\PROGRAM FILES\CA\ETRUST\ANTIVIRUS\INORPC.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\PROGRAM FILES\CA\ETRUST\ANTIVIRUS\REALMON.EXE
    C:\PROGRAM FILES\ZAFILES\ZONE LABS\ZONEALARM\ZAPRO.EXE
    C:\PROGRAM FILES\ANALOGX\POW\POW.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\MY DOCUMENTS\MAD\HIJACKTHIS\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?p=%s
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\YCOMP5_3_18_0.DLL
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN TOOLBAR\01.01.1601.0\EN-US\MSNTB.DLL
    O3 - Toolbar: WebFerret - {A58686ED-FC46-44C3-95C6-4A812AB776F1} - C:\Program Files\FerretSoft\WebFerret\FerretBand.dll
    O3 - Toolbar: Yahoo! Canada Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\YCOMP5_3_18_0.DLL
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST\ANTIVI~1\REALMON.EXE
    O4 - HKLM\..\Run: [OWCCardbusTray] ocbtray.exe
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [TrueVector] C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
    O4 - HKLM\..\RunServices: [MiniLog] C:\WINDOWS\SYSTEM\ZONELABS\MINILOG.EXE -service
    O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
    O4 - HKLM\..\RunServices: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
    O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
    O4 - HKLM\..\RunServices: [InoTask] C:\Program Files\CA\eTrust\Antivirus\InoTask.exe
    O4 - HKLM\..\RunServices: [InoRT] C:\Program Files\CA\eTrust\Antivirus\InoRT9x.exe
    O4 - HKLM\..\RunServices: [InoRPC] C:\Program Files\CA\eTrust\Antivirus\InoRpc.exe
    O4 - Startup: POW!.lnk = C:\Program Files\AnalogX\POW\pow.exe
    O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\zafiles\Zone Labs\ZoneAlarm\zapro.exe
    O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
    O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
    O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://cs2.chat.yahoo.com/v43/yacscom.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get...sh/swflash.cab
    O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
    O16 - DPF: {8842C6C0-E428-11D5-A74F-0008C7DA2EA8} (prjRogersMail.ctlMail) - http://www.rogershelp.com/addemail.cab
    O16 - DPF: {6D655755-EB1B-11D5-A74F-0008C7DA2EA8} (prjRemMail.ctlRemMail) - http://www.rogershelp.com/remmail.cab
    O16 - DPF: {2CDA4FA9-4A2B-4925-8EB4-61BDDE935A84} (OutlookVerification.vOutlook) - http://www.rogershelp.com/smtp/voutlook.cab
    O16 - DPF: {7CF052DE-C74F-421B-B04A-3B3037EF5887} (CCMPGui Class) - http://64.124.45.181/chaincast/proxy/CCMP.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...862.2939351852
    O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://officeupdate.microsoft.com/Te...loads/outc.cab
    O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://64.124.45.181/downloads/ccpm_0237.cab
    O16 - DPF: {EE5CA45C-BFAC-48E6-BE6C-3C607620FF43} (IMViewerControl Class) - http://companion.logitech.com/compan.../bin/imvid.cab
    O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Canada Companion) - http://us.dl1.yimg.com/download.comp...io5_3_18_0.cab
    My Web Site - 1970 Z28 Camaro
    Retired from 35 yrs IT Hardware Planning Analyst
    Cheers
    Mark

  2. #2
    Join Date
    Oct 2002
    Location
    Here, there and everywhere
    Posts
    7,355
    Log looks clean to me.
    Who are you? Introduce yourself here

    P3-450 powered by

    Intel Core 2 Duo E6600
    Gigabyte 965P DQ6
    4 Gig Crucial Ballistix PC6400
    Gainward Nvidia Geforce 7950GT
    2X Western Digital Caviar 320GB SATA2
    Soundblaster X-Fi XtremeMusic
    Samsung SH-D162C DVD Rom
    Lite-On SHM-165P6S DVDRW
    Samsung 20" LCD Syncmaster 206BW
    Thermaltake Kandalf VA9000SWA Tower
    Tagan Dual Engine 700W PSU
    XP PRO SP3/Windows 7 64-bit
    --------------
    Samsung NC10 2GB Ram
    Windows 7 32-bit

  3. #3
    Join Date
    Nov 1999
    Posts
    438
    thx very much!!

  4. #4
    Join Date
    Nov 1999
    Posts
    438
    Would Spybot and CWShredder, and adaware I have be able to find undetectable spyware?
    My Web Site - 1970 Z28 Camaro
    Retired from 35 yrs IT Hardware Planning Analyst
    Cheers
    Mark

  5. #5
    Join Date
    Oct 2002
    Location
    Here, there and everywhere
    Posts
    7,355
    Updating and running Adaware and Spybot regularly should get rid of most. CWShredder is no longer being updated so it wont be beneficial when it comes to new variants, it should only be run if you have a CoolWebSearch infection though.

    Also download Spyware Blaster, from my sig below. Keep it updated and enable all protection. This should help prevent spyware from entering your pc.
    Who are you? Introduce yourself here

    P3-450 powered by

    Intel Core 2 Duo E6600
    Gigabyte 965P DQ6
    4 Gig Crucial Ballistix PC6400
    Gainward Nvidia Geforce 7950GT
    2X Western Digital Caviar 320GB SATA2
    Soundblaster X-Fi XtremeMusic
    Samsung SH-D162C DVD Rom
    Lite-On SHM-165P6S DVDRW
    Samsung 20" LCD Syncmaster 206BW
    Thermaltake Kandalf VA9000SWA Tower
    Tagan Dual Engine 700W PSU
    XP PRO SP3/Windows 7 64-bit
    --------------
    Samsung NC10 2GB Ram
    Windows 7 32-bit

  6. #6
    Join Date
    Nov 1999
    Posts
    438
    yup, I forgot to mention that I already have spyblaster...thx again!
    My Web Site - 1970 Z28 Camaro
    Retired from 35 yrs IT Hardware Planning Analyst
    Cheers
    Mark

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •