Jump to content


Photo

HijackThis Log - Adware keeps coming back, CWS_NS3


  • Please log in to reply
No replies to this topic

#1 dp25

dp25

    Member

  • New Member
  • Pip
  • 1 posts

Posted 03 August 2004 - 10:58 AM

What's up fellas? got problems with my darn computer..PLEASE help me as soon as you can..I will reply immediately if something is needed. Here is my hijackthis log:

Logfile of HijackThis v1.98.1
Scan saved at 11:43:50 AM, on 8/3/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Nhksrv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\atlnf.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\System32\Promon.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
C:\WINDOWS\System32\hphmon03.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\sdkbm32.exe
C:\documents and settings\dave dickson\local settings\temp\wER5xeW.exe
C:\documents and settings\dave dickson\local settings\temp\LnB7sKveX.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\documents and settings\dave dickson\local settings\temp\agevbh.exe
C:\WINDOWS\System32\ds1gsnap.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\WINDOWS\System32\dsdestrt.exe
C:\WINDOWS\System32\lfras80n729v.exe
C:\Program Files\America Online 9.0e\aoltray.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\mngxo.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://mngxo.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\mngxo.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\mngxo.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {772CC3D1-9CAD-C2E5-2352-DDE9FB29DB19} - C:\WINDOWS\system32\ntvl.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\System32\hphmon03.exe
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [sdkbm32.exe] C:\WINDOWS\system32\sdkbm32.exe
O4 - HKLM\..\Run: [wER5xeW] C:\documents and settings\dave dickson\local settings\temp\wER5xeW.exe
O4 - HKLM\..\Run: [LnB7sKveX] C:\documents and settings\dave dickson\local settings\temp\LnB7sKveX.exe
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [agevbh] C:\documents and settings\dave dickson\local settings\temp\agevbh.exe
O4 - HKLM\..\Run: [33sj36Q] ds1gsnap.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\RunOnce: [winyh32.exe] C:\WINDOWS\system32\winyh32.exe
O4 - HKLM\..\RunOnce: [sysdt.exe] C:\WINDOWS\sysdt.exe
O4 - HKLM\..\RunOnce: [atlnf.exe] C:\WINDOWS\system32\atlnf.exe
O4 - HKLM\..\RunOnce: [sdkqu32.exe] C:\WINDOWS\system32\sdkqu32.exe
O4 - HKLM\..\RunOnce: [sdkhi.exe] C:\WINDOWS\sdkhi.exe
O4 - HKLM\..\RunOnce: [sysjn32.exe] C:\WINDOWS\sysjn32.exe
O4 - HKLM\..\RunOnce: [addcr.exe] C:\WINDOWS\addcr.exe
O4 - HKLM\..\RunOnce: [msrb32.exe] C:\WINDOWS\system32\msrb32.exe
O4 - HKLM\..\RunOnce: [sysft32.exe] C:\WINDOWS\sysft32.exe
O4 - HKLM\..\RunOnce: [sdkzd.exe] C:\WINDOWS\sdkzd.exe
O4 - HKLM\..\RunOnce: [atlry32.exe] C:\WINDOWS\system32\atlry32.exe
O4 - HKLM\..\RunOnce: [iesq.exe] C:\WINDOWS\system32\iesq.exe
O4 - HKLM\..\RunOnce: [iels.exe] C:\WINDOWS\iels.exe
O4 - HKLM\..\RunOnce: [crpy.exe] C:\WINDOWS\system32\crpy.exe
O4 - HKLM\..\RunOnce: [sdkix32.exe] C:\WINDOWS\sdkix32.exe
O4 - HKLM\..\RunOnce: [mshp32.exe] C:\WINDOWS\system32\mshp32.exe
O4 - HKLM\..\RunOnce: [sdkbz.exe] C:\WINDOWS\system32\sdkbz.exe
O4 - HKLM\..\RunOnce: [apiqo32.exe] C:\WINDOWS\system32\apiqo32.exe
O4 - HKLM\..\RunOnce: [atlcz32.exe] C:\WINDOWS\system32\atlcz32.exe
O4 - HKLM\..\RunOnce: [winem.exe] C:\WINDOWS\system32\winem.exe
O4 - HKLM\..\RunOnce: [netwi.exe] C:\WINDOWS\netwi.exe
O4 - HKLM\..\RunOnce: [ipjz.exe] C:\WINDOWS\ipjz.exe
O4 - HKLM\..\RunOnce: [apply32.exe] C:\WINDOWS\system32\apply32.exe
O4 - HKLM\..\RunOnce: [sdktb32.exe] C:\WINDOWS\system32\sdktb32.exe
O4 - HKLM\..\RunOnce: [mfcfw32.exe] C:\WINDOWS\mfcfw32.exe
O4 - HKLM\..\RunOnce: [d3px32.exe] C:\WINDOWS\d3px32.exe
O4 - HKLM\..\RunOnce: [ieqr32.exe] C:\WINDOWS\system32\ieqr32.exe
O4 - HKLM\..\RunOnce: [mfcfy.exe] C:\WINDOWS\mfcfy.exe
O4 - HKLM\..\RunOnce: [javajp32.exe] C:\WINDOWS\javajp32.exe
O4 - HKLM\..\RunOnce: [winmr32.exe] C:\WINDOWS\system32\winmr32.exe
O4 - HKLM\..\RunOnce: [addce.exe] C:\WINDOWS\system32\addce.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [I03tRWc3g] dsdestrt.exe
O4 - HKCU\..\Run: [lfras80n729v.exe] "C:\WINDOWS\System32\lfras80n729v.exe"
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0e\aoltray.exe
O4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exe
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: (no name) - {9B5600E2-F33B-4026-BED5-6BAEC2714F8C} - (no file) (HKCU)
O9 - Extra button: (no name) - {CD27B69A-2810-42F5-B0FF-9EE709C0EF7B} - (no file) (HKCU)
O9 - Extra button: (no name) - {FD108515-4073-4496-A4AA-88EEB5CCFBC7} - (no file) (HKCU)
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akama...meInstaller.exe
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com...kup/qdiagcc.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://cam5.brett-ro...sCamControl.cab
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abac...es/abasetup.cab




Member of UNITE
Support SpywareInfo Forum - click the button