grim_reefer Posted November 17, 2004 Report Share Posted November 17, 2004 im going to post here all the running processes from a computer i need to fix for someone, and am also going to post a hijackthis log from it running in safe mode. i know it has many virus/trojan/spyware/adware running on there because of all the pop-ups, and some of the "give-away" running process names like scvhost, how slow it is running, and how many running processes there are.. not to mention links/programs that reinstall after deletion due to being installed multiple places and the registry keys reactivating them.. i havent actually done anything yet, i could manually search the computer and find out which of the running processes are unwanted and fix the altered registry keys and delete all copies from the hard-drive! but it would be easier to post here and be advised the best course of action and speed things up with other peoples extra experience.. so anyway.. heres the running process list (not in safe mode)2NA5hGz4kcAraiah6AutoUpdateCalcheckcmdcsrssCxtPlsdpidwwineasyclipeEBsvcexplorerh1e6IEEXPLOREIEHostiexploreistsvckimochilsasslWRHmcafeeupdatemsnmsgrNILauncho2fROon191NpcsvcPICPMONppvcqzqttaskrealschedrnathchkrundll32rundll32SAgent2scvhosts1servservicessiservsmartctrsmssspoolsvsuitestsvchostsvchostsvchostsvchostsvchostSYSTEMSystem Idle Processtaskmgrtscvbtype32unimeterWet_Me!WinlogonWinregs32cdnand the hijackthis log (in safe mode)Logfile of HijackThis v1.98.2Scan saved at 20:28:53, on 15/11/2004Platform: Windows XP (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Documents and Settings\Administrator.OWNER-O7H24QFL5\Desktop\HijackThis.exeR1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://nkvd.us (obfuscated)R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.q-serve.com/signup.htmR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.q-serve.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://nkvd.us (obfuscated)R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://nkvd.us (obfuscated)R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://nkvd.us (obfuscated)R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://nkvd.us (obfuscated)R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://nkvd.us (obfuscated)O2 - BHO: (no name) - SOFTWARE - (no file)O2 - BHO: CSIECore Class - {00000000-0000-0000-0000-000000000221} - C:\Program Files\ClearSearch\CSIE.DLL (file missing)O2 - BHO: twaintecObj Class - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\twaintec.dllO2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:\Program Files\CxtPls\CxtPls.dllO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocxO2 - BHO: CBho404 Object - {087173EF-9829-4F49-8340-A524177D3F60} - C:\WINDOWS\System32\inetp60.dllO2 - BHO: MediaLoads Enhanced - {85A702BA-EA8F-4B83-AA07-07A5186ACD7E} - C:\Program Files\MediaLoads Enhanced\ME2.DLLO2 - BHO: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dllO2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\Mrs A Whiting\Local Settings\Temp\CHJERIVTa.dllO2 - BHO: OsbornTech Popup Blocker - {FF1BF4C7-4E08-4A28-A43F-9D60A9F7A880} - C:\WINDOWS\System32\mshelper.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: (no name) - {2CF0B992-5EEB-4143-99C0-5297EF71F444} - (no file)O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dllO4 - HKLM\..\Run: [] C:\WINDOWS\Options\OEMReset.exe /AuditO4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exeO4 - HKLM\..\Run: [Net-It Launcher] C:\WINDOWS\System32\NILaunch.exeO4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [Wet_Me!] C:\WINDOWS\Wet_Me!.exe -nO4 - HKLM\..\Run: [alchem] C:\WINDOWS\alchem.exeO4 - HKLM\..\Run: [yntgjlv] C:\WINDOWS\System32\ppvcqz.exeO4 - HKLM\..\Run: [o2fR] C:\documents and settings\mrs a whiting\local settings\temp\o2fR.exeO4 - HKLM\..\Run: [lWRH] C:\documents and settings\mrs a whiting\local settings\temp\lWRH.exeO4 - HKLM\..\Run: [Bakra] C:\WINDOWS\System32\IEHost.exeO4 - HKLM\..\Run: [{2CF0B992-5EEB-4143-99C0-5297EF71F444}] rundll32.exe C:\WINDOWS\System32\stlbdist.DLL,DllRunMainO4 - HKLM\..\Run: [4MFZP5M42D35L#] C:\WINDOWS\System32\CbgA2.exeO4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"O4 - HKLM\..\Run: [Pcsv] C:\WINDOWS\system32\pcs\pcsvc.exeO4 - HKLM\..\Run: [Dpi] C:\Program Files\Common Files\Dpi\dpi.exeO4 - HKLM\..\Run: [A5hGz4kc] C:\documents and settings\mrs a whiting\local settings\temp\A5hGz4kc.exeO4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exeO4 - HKLM\..\Run: [h1e6] C:\documents and settings\mrs a whiting\local settings\temp\h1e6.exeO4 - HKLM\..\Run: [Rundll32_8] rundll32.exe C:\WINDOWS\System32\inetp60.dll,DllRunServerO4 - HKLM\..\Run: [2N] C:\documents and settings\mrs a whiting\local settings\temp\2N.exeO4 - HKLM\..\Run: [System Startup] kimochi.exeO4 - HKLM\..\Run: [Windows SYSTEM] scvhost.exeO4 - HKLM\..\Run: [2sEh36O] tscvb.exeO4 - HKLM\..\Run: [Sygate Personal Firewall] mcafeeupdate.exeO4 - HKLM\..\Run: [Registry Checkup System32cd Monitor] Winregs32cdn.exeO4 - HKLM\..\RunServices: [System Startup] kimochi.exeO4 - HKLM\..\RunServices: [Windows SYSTEM] scvhost.exeO4 - HKLM\..\RunServices: [Sygate Personal Firewall] mcafeeupdate.exeO4 - HKLM\..\RunServices: [Registry Checkup System32cd Monitor] Winregs32cdn.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - Global Startup: Lotus Organizer EasyClip.lnk = C:\lotus\organize\easyclip.exeO4 - Global Startup: Lotus QuickStart.lnk = C:\lotus\wordpro\ltsstart.exeO4 - Global Startup: Lotus SmartCenter.lnk = C:\lotus\smartctr\smartctr.exeO4 - Global Startup: Lotus SuiteStart.lnk = C:\lotus\smartctr\suitest.exeO4 - Global Startup: Photo Express Calendar Checker SE.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exeO9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exeO9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exeO9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htmO9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htmO9 - Extra button: RealGuide - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXEO12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dllO13 - DefaultPrefix: http://%6E%6B%76%64%2E%75%73/O13 - WWW Prefix: http://%6E%6B%76%64%2E%75%73/O13 - Home Prefix: http://%6E%6B%76%64%2E%75%73/O13 - Mosaic Prefix: http://%6E%6B%76%64%2E%75%73/O14 - IERESET.INF: START_PAGE_URL=http://www.q-serve.comO16 - DPF: {03C543A1-C090-418F-A1D0-FB96380D601D} (preload control) - http://www.thepaymentcentre.com/build/preload.cabO16 - DPF: {093F9CF8-0DE1-491C-95D5-5EC257BD4CA3} - http://akamai.downloadv3.com/binaries/IA/dtc32_EN_XP.cabO16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cabO16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://activex.microsoft.com/activex/controls/macromedia/Swdir.cabO16 - DPF: {1E89F686-B78D-4C85-9EFC-3474516E3FE2} - http://directplugin.com/plugin/110060.exeO16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.spywarestormer.com/files2/Install.cabO16 - DPF: {4B9F2C37-C0CF-42BC-BB2D-DCFA8B25CABF} (PopCapLoaderCtrl Class) - http://zone.msn.com/bingame/rock/default/popcaploader1.cabO16 - DPF: {A48D0309-8DA3-41AA-98E4-89194D471890} (Pulse V5 ActiveX Control) - http://www.pulse3d.com/players/english/5.2/win/PulsePlayer5.2AxWin.cabO16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} - http://dload.ipbill.com/del/loader.cabO16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cabO16 - DPF: {C606BA60-AB76-48B6-96A7-2C4D5C386F70} (PreQualifier Class) - http://help.blueyonder.co.uk/html/software/instantsupport/tool/files/MotivePreQual.cabAlso get ongoing messages such as:The application or DLL C:\DOCUME~1\MRSAWH~1\LOCALS~1\Temp\dfa1.tmp is not a valid Windows image. Please check this against your installation diskette.also the same image and file location but replacing 'dfa1.tmp' with 'gra3.tmp', 'bsa3.tmp' and probably others too Quote Link to comment Share on other sites More sharing options...
nellie2 Posted November 17, 2004 Report Share Posted November 17, 2004 Is there any particular reason that you ran hijackthis in safe mode? It would be better if you could run it in normal mode then we could see everything that is running.With a log like this I would first of all recommend an online virus scan either here or using the Panda link at the top of the hijack forum or both.Then download, setup and update and run both Spybot and Adaware see here for links and instructions.Then run hijackthis again in normal mode and post a fresh log and we can deal with whats left if you like Quote Link to comment Share on other sites More sharing options...
grim_reefer Posted November 17, 2004 Author Report Share Posted November 17, 2004 thanx nellie when i go over there tomorrow evening ill do all of that, and if theres anything left ill post the hijack this log while therealso update windows and put Mozilla Firefox to use instead of IE Quote Link to comment Share on other sites More sharing options...
homecomputeraid Posted November 17, 2004 Report Share Posted November 17, 2004 My personal preference in troubleshooting is to get rid of viruses first and spyware second. You might try the latest version of Stinger and running it, especially if the viruses and scumware are limiting your Internet access. It's a small file. There are also some useful utilities on Sysinternals' Web Site such as TCPView that help you kill scumware processes and some viruses letting you get to the Internet.You might run a full virus scan with AVG Antivirus, or another free product after installing and updating with the latest signatures. Hope this helps! Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.