Hijack this log

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Private Joker, Jul 8, 2004.

  1. Private Joker

    Private Joker Private E-2

    I'm a newbie. I think I may have been hijacked because I can't update CWshredder. Also when I try to update windows at the microsoft page it just goes to a completley blank page.

    I use Windows XP Professional, Mozilla as my browser and have run ad aware 6 (which I was able to update), and spy-bot S&D(which removed a few spywares). I use AVG which is up to date. I also have zone alarm and BHODemon.

    CWShredder doesn't pick up anything, but as I said I am unable to update it.

    Have I been hijacked? Please help thanks.



    Logfile of HijackThis v1.98.0
    Scan saved at 12:16:13 PM, on 9/07/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\Program Files\ahead\InCD\InCD.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP4LAK.EXE
    C:\WINDOWS\System32\CAP4RSK.EXE
    C:\WINDOWS\System32\spool\drivers\w32x86\3\CAP4SWK.EXE
    C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
    C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\hijackthis\HijackThis.exe
    C:\Program Files\bhodmon1\BHODemon.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Grisoft\AVG6\avgcc32.exe
    C:\Program Files\mozilla.org\Mozilla\mozilla.exe

    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\\NVCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
    O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
    O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\mozilla.org\Mozilla\Mozilla.exe" -turbo
    O4 - Global Startup: Canon LBP3200 Status Window.LNK = C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP4LAK.EXE
     
    Private Joker, Jul 8, 2004
    #1
  2. Private Joker

    Private Joker Private E-2

    Is anyone going to respond?

    Could the fact that I can't get automatic updates from mircosoft be becuase of my Zone alarm firewall?
     
    Private Joker, Jul 9, 2004
    #2
  3. Just Playin

    Just Playin MajorGeek

    Mozilla doesn't support ActiveX, which you will need to access Windows Update. Just update through IE instead. Merijn is no longer updating CWshredder at this time, so there are no updates available. I use FF. Same thing happens.
     
    Just Playin, Jul 9, 2004
    #3
  4. Major Attitude

    Major Attitude Co-Owner MajorGeeks.Com Staff Member

    Your hijack this log is squeaky clean.
     
    Major Attitude, Jul 9, 2004
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Is that your complete HijaakThis log? You have nothing beyond the O4 lines?

    Please do this: Click Start, Run, and in the Open box enter the below:
    notepad c:\windows\system32\drivers\etc\hosts

    Copy and paste the info for your hosts file back here.
     
    chaslang, Jul 9, 2004
    #5
  6. Private Joker

    Private Joker Private E-2

    That was my hijack this log. It is now

    Logfile of HijackThis v1.98.0
    Scan saved at 2:16:04 PM, on 13/07/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\CAP4RSK.EXE
    C:\Program Files\Grisoft\AVG6\avgcc32.exe
    C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
    C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP4LAK.EXE
    C:\WINDOWS\System32\spool\drivers\w32x86\3\CAP4SWK.EXE
    C:\Program Files\mozilla.org\Mozilla\mozilla.exe
    C:\Program Files\hijackthis\HijackThis.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\\NVCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
    O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
    O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - Global Startup: Canon LBP3200 Status Window.LNK = C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP4LAK.EXE
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O17 - HKLM\System\CCS\Services\Tcpip\..\{B8D28366-854D-41B6-97E0-4839B4A59A8A}: NameServer = 130.102.2.15 130.102.128.43

    and that thing you wanted me to post is:

    # Copyright (c) 1993-1999 Microsoft Corp.
    #
    # This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
    #
    # This file contains the mappings of IP addresses to host names. Each
    # entry should be kept on an individual line. The IP address should
    # be placed in the first column followed by the corresponding host name.
    # The IP address and the host name should be separated by at least one
    # space.
    #
    # Additionally, comments (such as these) may be inserted on individual
    # lines or following the machine name denoted by a '#' symbol.
    #
    # For example:
    #
    # 102.54.94.97 rhino.acme.com # source server
    # 38.25.63.10 x.acme.com # x client host

    127.0.0.1 localhost
     
    Private Joker, Jul 13, 2004
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    HijackThis log and hosts file look okay.

    Do you recognize the IP addresses though in your HijackThis log:
    130.102.2.15 krefti.cc.uq.edu.au
     
    chaslang, Jul 13, 2004
    #7
  8. Private Joker

    Private Joker Private E-2

    well I think I recognize that. But it wasn't there in my first Hijack this log, and everything worked fine. So should I "fix" it?
     
    Private Joker, Jul 13, 2004
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If you recognize it, leave it alone. It probably was in your first log but you did not cut and paste the whole log in the first time.


    Stop trying to update CWShredder. Just download the latest from here:
    http://www.majorgeeks.com/download4086.html

    Then run it.

    Also download and run this:
    http://www.majorgeeks.com/download4113.html
     
    chaslang, Jul 13, 2004
    #9

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds