Jump to content


Photo

reoccurring hijack


  • Please log in to reply
5 replies to this topic

#1 bcollins

bcollins

    Member

  • Full Member
  • Pip
  • 8 posts

Posted 09 June 2004 - 12:21 PM

No matter how or how many times I hunt this file down and think it is exterminated it inevitably comes back. Have read all articles and followed all instructions provided to the best of my ability. Have used Ad-Ware6.0 and HijackThis-v1.97.7 but this thing still persists. ...HELP! :rofl:

Following is most recent Hijackthis log:
Logfile of HijackThis v1.97.7
Scan saved at 11:53:13 AM, on 6/9/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\PROGRA~1\NORTON~2\SPEEDD~1\nopdb.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Brenda\My Documents\Fix its and patches\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://mshp.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://mshp.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://mshp.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://mshp.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://mshp.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://mshp.dll/sp.html#37049
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Image] rundll32 C:\WINDOWS\image.dll,Install
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\RunServices: [Image] rundll32 C:\WINDOWS\image.dll,Install

Much apreciation to anyone that can figure this out.

#2 bcollins

bcollins

    Member

  • Full Member
  • Pip
  • 8 posts

Posted 09 June 2004 - 02:34 PM

"Bump"

#3 bcollins

bcollins

    Member

  • Full Member
  • Pip
  • 8 posts

Posted 09 June 2004 - 02:48 PM

"Bump"

#4 bcollins

bcollins

    Member

  • Full Member
  • Pip
  • 8 posts

Posted 09 June 2004 - 06:26 PM

"bump"

#5 bcollins

bcollins

    Member

  • Full Member
  • Pip
  • 8 posts

Posted 10 June 2004 - 05:57 AM

:grrr: "bump"

#6 bcollins

bcollins

    Member

  • Full Member
  • Pip
  • 8 posts

Posted 10 June 2004 - 11:22 AM

Is there anybody out there?




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button