Jump to content


new log file

  • This topic is locked This topic is locked
3 replies to this topic

#1 chiri1650



  • New Member
  • Pip
  • 1 posts

Posted 07 June 2007 - 10:57 AM

Thanks for look at this log file :D . Chiri1650

StartupList report, 07-06-2007, 9:16:12
StartupList version: 1.52.2
Started from : C:\Dokumente und Einstellungen\Administrator\Desktop\hijackthis\HijackThis.EXE
Detected: Windows 2000 SP4 (WinNT 5.00.2195)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options

Running processes:

C:\Programme\Gemeinsame Dateien\Symantec Shared\ccEvtMgr.exe
C:\Programme\Norton AntiVirus\navapsvc.exe
C:\Programme\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\Programme\Hewlett-Packard\Erweiterte Tastatur\HpMmKbd.exe
C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe
C:\Programme\WEB.DE\WEB.DE SmartDrive Manager\DAVSRV.EXE
C:\Programme\Zone Labs\ZoneAlarm\zapro.exe
C:\Programme\Skype\Plugin Manager\skypePM.exe
C:\Dokumente und Einstellungen\Administrator\Desktop\hijackthis\HijackThis.exe


Listing of startup folders:

Shell folders Common Startup:
[C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart]
Microsoft Office.lnk = C:\Programme\Microsoft Office\Office\OSA9.EXE
ZoneAlarm Pro.lnk = C:\Programme\Zone Labs\ZoneAlarm\zapro.exe


Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,


Autorun entries from Registry:

SystemTray = SysTray.Exe
HpMmKbd = "C:\Programme\Hewlett-Packard\Erweiterte Tastatur\HpMmKbd.exe"
SMARTAlerts = C:\Programme\HP\SMART\SMARTAlerts.exe
ccApp = "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe"
ccRegVfy = "C:\Programme\Gemeinsame Dateien\Symantec Shared\ccRegVfy.exe"
Advanced Tools Check = C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
Synchronization Manager = mobsync.exe /logon
SkyE = C:\Programme\SkyE2A\SkyE2A.exe


Autorun entries from Registry:

WEB.DE_WEB.DE SmartDrive Manager = "C:\Programme\WEB.DE\WEB.DE SmartDrive Manager\DAVSRV.EXE" /hide
msnmsgr = "C:\Programme\MSN Messenger\msnmsgr.exe" /background


Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*


Enumerating Browser Helper Objects:

(no name) - (no file) - rsion
(no name) - C:\WINDOWS\system32\wmdmps32.dll - {22B1AF23-78A1-4286-909B-B1A4EB0622C1}
NAV Helper - C:\Programme\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}


Enumerating Task Scheduler jobs:

Norton AntiVirus - Meinen Computer prüfen.job
Symantec NetDetect.job


Enumerating Download Program Files:

[YInstStarter Class]
CODEBASE = http://us.dl1.yimg.c...nst20040510.cab

CODEBASE = http://download.micr...922/wmv9VCM.CAB

[RdxIE Class]
CODEBASE = http://software-dl.r...ip/RdxIE601.cab

[PhotoPickConvert Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\PhtPkMSN.dll
CODEBASE = http://appdirectory....ap/PhtPkMSN.cab

[InetDownload Class]
CODEBASE = http://www.arcor.de/.../WMDownload.cab

[Shockwave Flash Object]
CODEBASE = http://fpdownload.ma...ash/swflash.cab


Enumerating ShellServiceObjectDelayLoad items:

Network.ConnectionTray: C:\WINDOWS\system32\NETSHELL.dll
WebCheck: C:\WINDOWS\system32\webcheck.dll
SysTray: stobject.dll
WEzCpFnOPg: *Registry value not found*

End of report, 5.948 bytes
Report generated in 1,843 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

#2 SWI Support Robot

SWI Support Robot

    Helper robot

  • SWI Bot
  • PipPipPipPipPip
  • 23,522 posts

Posted 10 June 2007 - 06:30 AM

Welcome to SWI. We apologize for the delay; our helpers have been very busy.
If you have not received help after 3 days, please CLICK HERE, and post a link to your log and the date it was originally posted.

Thank you for your patience.

[this is an automated reply]
This is an automated message. It does not count as help.

#3 Chancellor


    Forum Deity

  • Emeritus
  • PipPipPipPipPip
  • 3,020 posts

Posted 21 June 2007 - 03:38 PM


Sorry you’ve had to wait for a few days but all of the helpers here are volunteers and we’ve been really busy recently.

To begin with, please download Dr.Web CureIt to the desktop:
  • Doubleclick the drweb-cureit.exe file and Allow to run the express scan
  • This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
  • Once the short scan has finished, Click Options > Change settings
  • Choose the "Scan"-tab, remove the mark at "Heuristic analysis".
  • Back at the main window, mark the drives that you want to scan.
  • Select all drives. A red dot shows which drives have been chosen.
  • Click the green arrow at the right, and the scan will start.
  • Click 'Yes to all' if it asks if you want to cure/move the file.
  • When the scan has finished, look if you can click next icon next to the files found: Posted Image
  • If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:
    Posted Image
    This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
  • After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
  • Save the report to your desktop. The report will be called DrWeb.csv
  • Close Dr.Web Cureit.
  • Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
  • After reboot, post the contents of the log from Dr.Web you saved previously in your next reply.
I’ll look out for your reply :)

Please consider a donation to help Support SWI
Malware Complaints - Report them here and fight back!
Member of ASAP Since 2006 (Alliance of Security Analysis Professionals)
Please read the FAQ and the article "So how did I get infected in the first place?".

#4 Chancellor


    Forum Deity

  • Emeritus
  • PipPipPipPipPip
  • 3,020 posts

Posted 01 July 2007 - 07:57 AM

Due to the lack of feedback, this topic is closed.

If you need this topic reopened, please tell the moderating team by replying here with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.

Please consider a donation to help Support SWI
Malware Complaints - Report them here and fight back!
Member of ASAP Since 2006 (Alliance of Security Analysis Professionals)
Please read the FAQ and the article "So how did I get infected in the first place?".

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button