PCTech Forums

A friendly computer support place
https://www.pctechforums.com/

hijack this log

https://www.pctechforums.com/viewtopic.php?f=22&t=2529

Page 1 of 1

hijack this log

PostPosted: Tue Jul 13, 2004 7:00 pm
by blackbaro
My browser keeps getting forwarded to some page [random].dll file on my hard drive
tried deleting stuff that looked suspicious :

appiv.exe,appsm keeps getting back
the rest i deleted stays away (as sdksdk.exe, and more.. )

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\WINDOWS\System32\r_server.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\systy32.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\WINDOWS\System32\sistray.EXE
C:\WINDOWS\system32\ntgp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINDOWS\twain_32\A4CIS600\WATCH.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\taskmgr.exe
C:\totalcmd\TOTALCMD.EXE
c:\michael\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\msizz.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://msizz.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://msizz.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\msizz.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://msizz.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\msizz.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.pandora.be:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AD4D75B9-68DD-52FB-F33A-64E5C0E44B5B} - C:\WINDOWS\system32\ieae32.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\System32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [mfcoz32.exe] C:\WINDOWS\system32\mfcoz32.exe
O4 - HKLM\..\Run: [appsm.exe] C:\WINDOWS\system32\appsm.exe
O4 - HKLM\..\Run: [ntgp.exe] C:\WINDOWS\system32\ntgp.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKLM\..\RunOnce: [appiv.exe] C:\WINDOWS\system32\appiv.exe
O4 - HKLM\..\RunOnce: [javacv.exe] C:\WINDOWS\javacv.exe
O4 - HKLM\..\RunOnce: [sdkon.exe] C:\WINDOWS\sdkon.exe
O4 - HKLM\..\RunOnce: [apibn.exe] C:\WINDOWS\apibn.exe
O4 - HKLM\..\RunOnce: [sdksu32.exe] C:\WINDOWS\sdksu32.exe
O4 - HKLM\..\RunOnce: [systy32.exe] C:\WINDOWS\systy32.exe
O4 - HKLM\..\RunOnce: [ntda32.exe] C:\WINDOWS\ntda32.exe
O4 - HKLM\..\RunOnce: [ntdc32.exe] C:\WINDOWS\ntdc32.exe
O4 - HKLM\..\RunOnce: [atlvf32.exe] C:\WINDOWS\atlvf32.exe
O4 - HKLM\..\RunOnce: [appru32.exe] C:\WINDOWS\system32\appru32.exe
O4 - HKLM\..\RunOnce: [apinp32.exe] C:\WINDOWS\system32\apinp32.exe
O4 - Startup: Watch.lnk = C:\WINDOWS\twain_32\A4CIS600\WATCH.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Onderzoek (HKLM)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdat ... t/opuc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shoc ... wflash.cab

PostPosted: Tue Jul 13, 2004 8:41 pm
by liljim
Please post your entire logfile

--------------------------------------------------------------
EX:
Logfile of HijackThis v1.98.0
Scan saved at 9:22:57 PM, on 7/12/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
--------------------------------------------------------------

This part is also important,it lets us know what OS your running and if its up to date.

PostPosted: Tue Jul 13, 2004 8:57 pm
by blackbaro
ok here he is:
Logfile of HijackThis v1.98.0
Scan saved at 22:03:49, on 13/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\systy32.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\WINDOWS\crhf32.exe
C:\WINDOWS\System32\sistray.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\totalcmd\TOTALCMD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
c:\michael\HijackThis.exe
c:\michael\hijack this\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\cevps.dll/sp.html#12802
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://cevps.dll/index.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://cevps.dll/index.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\cevps.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\cevps.dll/sp.html#12802
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://cevps.dll/index.html#12802
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.pandora.be:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {02CC75F3-8484-D1DD-2BFB-DC68547A67BA} - C:\WINDOWS\system32\netjj.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {44E45869-432D-7E42-D253-048EAF61F303} - C:\WINDOWS\system32\appsm.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\System32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [appsm.exe] C:\WINDOWS\system32\appsm.exe
O4 - HKLM\..\Run: [crhf32.exe] C:\WINDOWS\crhf32.exe
O4 - HKLM\..\RunOnce: [sdksu32.exe] C:\WINDOWS\sdksu32.exe
O4 - HKLM\..\RunOnce: [systy32.exe] C:\WINDOWS\systy32.exe
O4 - HKLM\..\RunOnce: [ntda32.exe] C:\WINDOWS\ntda32.exe
O4 - HKLM\..\RunOnce: [ntdc32.exe] C:\WINDOWS\ntdc32.exe
O4 - HKLM\..\RunOnce: [atlvf32.exe] C:\WINDOWS\atlvf32.exe
O4 - HKLM\..\RunOnce: [appru32.exe] C:\WINDOWS\system32\appru32.exe
O4 - HKLM\..\RunOnce: [apinp32.exe] C:\WINDOWS\system32\apinp32.exe
O4 - HKLM\..\RunOnce: [addis.exe] C:\WINDOWS\addis.exe
O4 - HKLM\..\RunOnce: [javauo32.exe] C:\WINDOWS\system32\javauo32.exe
O4 - HKLM\..\RunOnce: [msvp.exe] C:\WINDOWS\system32\msvp.exe
O4 - HKLM\..\RunOnce: [winfc.exe] C:\WINDOWS\winfc.exe
O4 - HKLM\..\RunOnce: [winho32.exe] C:\WINDOWS\system32\winho32.exe
O4 - HKLM\..\RunOnce: [netsi.exe] C:\WINDOWS\netsi.exe
O4 - HKLM\..\RunOnce: [apicm.exe] C:\WINDOWS\apicm.exe
O4 - HKLM\..\RunOnce: [sysdy32.exe] C:\WINDOWS\system32\sysdy32.exe
O4 - HKLM\..\RunOnce: [adddb.exe] C:\WINDOWS\adddb.exe
O4 - HKLM\..\RunOnce: [ntri.exe] C:\WINDOWS\system32\ntri.exe
O4 - HKLM\..\RunOnce: [appui32.exe] C:\WINDOWS\appui32.exe
O4 - HKLM\..\RunOnce: [mfcul32.exe] C:\WINDOWS\system32\mfcul32.exe
O4 - HKLM\..\RunOnce: [ntks32.exe] C:\WINDOWS\system32\ntks32.exe
O4 - HKLM\..\RunOnce: [mfcrm.exe] C:\WINDOWS\mfcrm.exe
O4 - HKLM\..\RunOnce: [ipnk.exe] C:\WINDOWS\system32\ipnk.exe
O4 - HKLM\..\RunOnce: [atlfd.exe] C:\WINDOWS\atlfd.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2004 ... scan53.cab

[edit] i used an older version, now it's the 1.98 version log

PostPosted: Tue Jul 13, 2004 9:01 pm
by blackbaro
i got desperate and i deleted ALL the runonce and run entries and the appsm.dll(BHO) and then i shut down my computer by pressing the ON/OFF hardware button.
When my computer had rebooted and i ran hijack this, all the runonce and run entries were restored :mad:

PostPosted: Tue Jul 13, 2004 9:31 pm
by brad
If you've rebooted since this HJT Log this may not work.

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following: (They may or may not be there)

systy32.exe
crhf32.exe

Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.)
(This would also include the “GoBack” Program if it is installed.)
Close all other open Windows and have HiJackThis Fix:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zhpcm.dll/sp.html#12802
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://zhpcm.dll/index.html#12802
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://zhpcm.dll/index.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zhpcm.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://zhpcm.dll/index.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\zhpcm.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.pandora.be:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {44E45869-432D-7E42-D253-048EAF61F303} - C:\WINDOWS\system32\appsm.dll
O4 - HKLM\..\Run: [appsm.exe] C:\WINDOWS\system32\appsm.exe
O4 - HKLM\..\RunOnce: [sdksu32.exe] C:\WINDOWS\sdksu32.exe
O4 - HKLM\..\RunOnce: [systy32.exe] C:\WINDOWS\systy32.exe
O4 - HKLM\..\RunOnce: [ntda32.exe] C:\WINDOWS\ntda32.exe
O4 - HKLM\..\RunOnce: [ntdc32.exe] C:\WINDOWS\ntdc32.exe
O4 - HKLM\..\RunOnce: [atlvf32.exe] C:\WINDOWS\atlvf32.exe
O4 - HKLM\..\RunOnce: [appru32.exe] C:\WINDOWS\system32\appru32.exe
O4 - HKLM\..\RunOnce: [apinp32.exe] C:\WINDOWS\system32\apinp32.exe
O4 - HKLM\..\RunOnce: [addis.exe] C:\WINDOWS\addis.exe
O4 - HKLM\..\RunOnce: [javauo32.exe] C:\WINDOWS\system32\javauo32.exe
O4 - HKLM\..\RunOnce: [msvp.exe] C:\WINDOWS\system32\msvp.exe
O4 - HKLM\..\RunOnce: [winfc.exe] C:\WINDOWS\winfc.exe
O4 - HKLM\..\RunOnce: [winho32.exe] C:\WINDOWS\system32\winho32.exe
O4 - HKLM\..\RunOnce: [netsi.exe] C:\WINDOWS\netsi.exe
O4 - HKLM\..\RunOnce: [apicm.exe] C:\WINDOWS\apicm.exe
O4 - HKLM\..\RunOnce: [sysdy32.exe] C:\WINDOWS\system32\sysdy32.exe
O4 - HKLM\..\RunOnce: [adddb.exe] C:\WINDOWS\adddb.exe
O4 - HKLM\..\RunOnce: [ntri.exe] C:\WINDOWS\system32\ntri.exe
O4 - HKLM\..\RunOnce: [appui32.exe] C:\WINDOWS\appui32.exe
O4 - HKLM\..\RunOnce: [mfcul32.exe] C:\WINDOWS\system32\mfcul32.exe
O4 - HKLM\..\RunOnce: [ntks32.exe] C:\WINDOWS\system32\ntks32.exe
O4 - HKLM\..\RunOnce: [mfcrm.exe] C:\WINDOWS\mfcrm.exe
O4 - HKLM\..\RunOnce: [ipnk.exe] C:\WINDOWS\system32\ipnk.exe
O4 - HKLM\..\RunOnce: [atlfd.exe] C:\WINDOWS\atlfd.exe
O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe


Go to Control Panel / Add/Remove Programs and remove the following if they are there:

GMT
Gator

Now delete these Folders or Files that are Highlighted: (You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) (You may have to boot to "Safe Mode" in order to delete some Files/Folders)

C:\WINDOWS\system32\appsm.dll
C:\Program Files\Common Files\GMT
C:\WINDOWS\zhpcm.dll
C:\WINDOWS\sdksu32.exe
C:\WINDOWS\systy32.exe
C:\WINDOWS\ntda32.exe
C:\WINDOWS\ntdc32.exe
C:\WINDOWS\atlvf32.exe
C:\WINDOWS\system32\appru32.exe
C:\WINDOWS\system32\apinp32.exe
C:\WINDOWS\addis.exe
C:\WINDOWS\system32\javauo32.exe
C:\WINDOWS\system32\msvp.exe
C:\WINDOWS\winfc.exe
C:\WINDOWS\system32\winho32.exe
C:\WINDOWS\netsi.exe[/b]
C:\WINDOWS\apicm.exe
C:\WINDOWS\system32\sysdy32.exe
C:\WINDOWS\adddb.exe
C:\WINDOWS\system32\ntri.exe
C:\WINDOWS\appui32.exe
C:\WINDOWS\system32\mfcul32.exe
C:\WINDOWS\system32\ntks32.exe
C:\WINDOWS\mfcrm.exe
C:\WINDOWS\system32\ipnk.exe
C:\WINDOWS\atlfd.exe
C:\WINDOWS\zhpcm.dll

Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin" and reboot.

brad