Help Me Out Here Guys

Gimpi · December 24, 2004

I really need your help here guys. Please, read this log and tell me what to do. I won't be here all night, so, the sooner the better. Thanks.

Logfile of HijackThis v1.99.0

Scan saved at 7:29:11 PM, on 12/23/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\cisvc.exe

c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

c:\PROGRA~1\mcafee.com\vso\mcshield.exe

C:\WINDOWS\system32\cidaemon.exe

C:\Program Files\Real\RealPlayer\RealPlay.exe

C:\Program Files\McAfee.com\Agent\mcagent.exe

C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe

C:\Program Files\Common Files\Dell\EUSW\Support.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe

C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe

C:\docume~1\chrisk~1\locals~1\temp\dpf0WR.exe

C:\docume~1\chrisk~1\locals~1\temp\yWY.exe

C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

C:\WINDOWS\System32\d3detobj.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\AIM95\aim.exe

C:\PROGRA~1\COMMON~1\tsa\tsm2.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\PROGRA~1\COMMON~1\tsa\ts2.exe

C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe

C:\WINDOWS\system\diskweb.exe

C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe

c:\windows\8ScUs5OP.exe

C:\WINDOWS\Tasks\pcav.exe

C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe

C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe

c:\windows\x.exe

C:\Program Files\CxtPls\CxtPls.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\explorer.exe

C:\Documents and Settings\Jodi Koch\Desktop\HijackThis.exe

C:\WINDOWS\system\svrwin.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.longnet.net/login.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)

O1 - Hosts: com

O1 - Hosts: nu.com

O1 - Hosts: enu.com

O1 - Hosts: henu.com

O1 - Hosts: .whenu.com

O1 - Hosts: c.whenu.com

O1 - Hosts: nc.whenu.com

O2 - BHO: (no name) - SOFTWARE - (no file)

O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:\Program Files\CxtPls\cxtpls.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll

O2 - BHO: CATLEvents Object - {3EC8E271-FAB9-418a-8A8E-65AEB4029E64} - C:\DOCUME~1\CHRISK~1\LOCALS~1\Temp\rvskab.dat

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: (no name) - {72AC6865-B1D3-4C32-A27B-4B3BF04DE655} - (no file)

O2 - BHO: CATLEvents Object - {8109AF33-6949-4833-8881-43DCC232B7B2} - C:\DOCUME~1\CHRISK~1\LOCALS~1\Temp\rvskab.dat

O2 - BHO: (no name) - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - (no file)

O2 - BHO: (no name) - {C69FA570-7FDE-4C49-A7BC-CB1CF24BE66B} - (no file)

O2 - BHO: Band Class - {CC378B83-9577-44D0-B4F8-0DD965E176FC} - C:\Program Files\eSyndicate\esyn.dll

O2 - BHO: Search Help - {E8EAEB34-F7B5-4C55-87FF-720FAF53D841} - C:\Documents and Settings\Jodi Koch\Local Settings\Temp\98Z6LTm.dll

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

O4 - HKLM\..\Run: [MCAgentExe] C:\Program Files\McAfee.com\Agent\mcagent.exe

O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe

O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"

O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe

O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [dpf0WR] C:\docume~1\chrisk~1\locals~1\temp\dpf0WR.exe

O4 - HKLM\..\Run: [yWY] C:\docume~1\chrisk~1\locals~1\temp\yWY.exe

O4 - HKLM\..\Run: [ZeX69Fea] C:\documents and settings\chris koch\local settings\temp\ZeX69Fea.exe

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

O4 - HKLM\..\Run: [*cabole] C:\WINDOWS\AppPatch\cabole.exe

O4 - HKLM\..\Run: [*wmsac] C:\WINDOWS\system\wmsac.exe

O4 - HKLM\..\Run: [*catwms] C:\WINDOWS\Microsoft.NET\catwms.exe

O4 - HKLM\..\Run: [*antidoc] C:\WINDOWS\msagent\CHARS\antidoc.exe

O4 - HKLM\..\Run: [*dllc] C:\WINDOWS\Registration\dllc.exe

O4 - HKLM\..\Run: [*ipabr] C:\WINDOWS\ipabr.exe

O4 - HKLM\..\Run: [*svcinet] C:\WINDOWS\system\svcinet.exe

O4 - HKLM\..\Run: [*faxcr] C:\WINDOWS\assembly\temp\faxcr.exe

O4 - HKLM\..\Run: [*pcwave] C:\WINDOWS\assembly\temp\pcwave.exe

O4 - HKLM\..\Run: [*libexp] C:\WINDOWS\Cursors\libexp.exe

O4 - HKLM\..\Run: [*adcom] C:\WINDOWS\addins\adcom.exe

O4 - HKLM\..\Run: [vs9k3EO] d3detobj.exe

O4 - HKLM\..\Run: [*mfcftp] C:\WINDOWS\system32\CatRoot2\mfcftp.exe

O4 - HKLM\..\Run: [*binole] C:\WINDOWS\Registration\binole.exe

O4 - HKLM\..\Run: [8ScUs5OP] c:\windows\8ScUs5OP.exe

O4 - HKLM\..\Run: [x] c:\windows\x.exe

O4 - HKLM\..\RunOnce: [*pcwave] C:\WINDOWS\assembly\temp\pcwave.exe rerun

O4 - HKLM\..\RunOnce: [*mfcftp] C:\WINDOWS\system32\CatRoot2\mfcftp.exe rerun

O4 - HKLM\..\RunOnce: [*binole] C:\WINDOWS\Registration\binole.exe rerun

O4 - HKLM\..\RunOnce: [*adcom] C:\WINDOWS\addins\adcom.exe rerun

O4 - HKLM\..\RunOnce: [*libexp] C:\WINDOWS\Cursors\libexp.exe rerun

O4 - HKLM\..\RunOnce: [*wmsinet] C:\WINDOWS\Config\wmsinet.exe rerun

O4 - HKLM\..\RunOnce: [*faxlog] C:\WINDOWS\assembly\temp\faxlog.exe rerun

O4 - HKLM\..\RunOnce: [*faxcr] C:\WINDOWS\assembly\temp\faxcr.exe rerun

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl

O4 - HKCU\..\Run: [PopUpStopperCompanion] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSComp.exe"

O4 - HKCU\..\Run: [ClockSync] C:\PROGRA~1\CLOCKS~1\Sync.exe /q

O4 - HKCU\..\Run: [Tsa2] C:\PROGRA~1\COMMON~1\tsa\tsm2.exe

O4 - HKCU\..\RunOnce: [*WinLogon] C:\WINDOWS\system\svrwin.exe ren time:1103658999

O4 - Global Startup: Digital Line Detect.lnk = ?

O4 - Global Startup: HPAiODevice(hp officejet d series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) - http://us.games2.yimg.com/download.games.y...ctl_0_0_0_1.ocx

O16 - DPF: {CFCB7308-782F-11D4-BE27-000102598CE4} (NPX Control) - http://kr.pristontale.com/nprotect/nprotect/npx.cab

O23 - Service: McAfee.com McShield - Unknown - c:\PROGRA~1\mcafee.com\vso\mcshield.exe

O23 - Service: McAfee.com VirusScan Online Realtime Engine - Mcafee.com Corporation - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe

O23 - Service: Intel® NMS - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe

O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

-gimp

Gimpi · December 24, 2004

Alright heres another, note: the longnet stuff is ok, it's for long reality where she works. Thanks again.

Logfile of HijackThis v1.99.0

Scan saved at 7:59:33 PM, on 12/23/2004

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\cisvc.exe

c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

c:\PROGRA~1\mcafee.com\vso\mcshield.exe

C:\WINDOWS\system32\cidaemon.exe

C:\Program Files\Real\RealPlayer\RealPlay.exe

C:\Program Files\McAfee.com\Agent\mcagent.exe

C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe

C:\Program Files\Common Files\Dell\EUSW\Support.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe

C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

C:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe

C:\docume~1\chrisk~1\locals~1\temp\dpf0WR.exe

C:\docume~1\chrisk~1\locals~1\temp\yWY.exe

C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

C:\WINDOWS\System32\d3detobj.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\AIM95\aim.exe

C:\PROGRA~1\COMMON~1\tsa\tsm2.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\PROGRA~1\COMMON~1\tsa\ts2.exe

C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe

C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe

c:\windows\8ScUs5OP.exe

C:\WINDOWS\Tasks\pcav.exe

C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe

C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe

c:\windows\x.exe

C:\Program Files\CxtPls\CxtPls.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\explorer.exe

C:\Documents and Settings\Jodi Koch\Desktop\HijackThis.exe

C:\WINDOWS\system\svrwin.exe

F:\Programs\Misc\TinyIRC\TinyIRC.exe