Help with Highjackthis log

[Fiendforeva]

Hello, I just recently got Highjackthis and was wondering if someone could help me in what I should do in regards to this log. :o

Logfile of HijackThis v1.98.0
Scan saved at 11:41:18 AM, on 7/9/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\system32\intel32.exe
C:\Program Files\Funcom\Anarchy Online\client.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\WINDOWS\system32\drwtsn32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Jeff Holder.JEFFSCOMP\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

res://C:\DOCUME~1\JEFFHO~1.JEF\LOCALS~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =

res://C:\DOCUME~1\JEFFHO~1.JEF\LOCALS~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {D479C3B3-273A-439F-A5D6-FDDCE2DC325E} - C:\WINDOWS\system32\amfl.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe"

/L ElbyCDFL
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\JEFFHO~1.JEF\LOCALS~1\Temp\se.dll,DllInstall
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O18 - Filter: text/html - {BCAC5015-24C8-4B66-A602-D1A2D3327D4F} -

C:\WINDOWS\system32\amfl.dll
O18 - Filter: text/plain - {BCAC5015-24C8-4B66-A602-D1A2D3327D4F} -

C:\WINDOWS\system32\amfl.dll

[DMR]

Hi Fiendforeva, welcome to the site. :)

The log you posted definitely shows signs of infections, but there are a few things you need to take care of before we can begin to work onit:

1. Logfile of HijackThis v1.98.0

The log entry above indicates that you are using a very old version (1.98.0) of HijackThis. Please download the latest version (1.99.1) and post the log it generates.

http://www.stevewolfonline.com/Downloads/DMR/Spyware%20Tools/HJT/HijackThis.exe

Once downloaded, create a folder outside of any Temp/Temporary folders for HJT and move it there now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.

2. C:\Program Files\Internet Explorer\iexplore.exe

The log entry above indicates that you had at least 1 instance of Internet Explorer running when you ran HijackThis. Before actually fixing problems with HijackThis, you should close all other open programs, especially your web browser and Windows Explorer. HijackThis cannot fully perform its fixes while any instances of your web browser are open.

3. The log you did post has odd line breaks and the like in it, which makes it difficult to read. Make sure the new log you post doesn't come out "fractured" like that.

[Fiendforeva]

Alright, I got the new version of HJT, closed all windows, I think I got it right this time. And thank you for the fast reply :mrgreen:

Logfile of HijackThis v1.99.1
Scan saved at 4:11:26 PM, on 7/10/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Jeff Holder.JEFFSCOMP\Desktop\highjack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\JEFFHO~1.JEF\LOCALS~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\JEFFHO~1.JEF\LOCALS~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {AC041E98-2B0B-4F4B-B30A-9347102B4C14} - C:\WINDOWS\system32\amfl.dll
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\JEFFHO~1.JEF\LOCALS~1\Temp\se.dll,DllInstall
O18 - Filter: text/html - {9A8BBFF4-F181-4333-9D0D-BC403740D165} - C:\WINDOWS\system32\amfl.dll
O18 - Filter: text/plain - {9A8BBFF4-F181-4333-9D0D-BC403740D165} - C:\WINDOWS\system32\amfl.dll
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[Fiendforeva]

hmmm, Sorry about the strange line breaks again, it looked alright in the preview.. :(

[DMR]

hmmm, Sorry about the strange line breaks again, it looked alright in the preview.. :(

I edited the post to clean up the formatting a bit. :)

That log looks very short on content for a normal XP computer, and it's missing a lot of entries that appeared in the first log you posted. Did your latest log come from a scan done while booted into Safe Mode? If so, you need to do a scan while booted normally and post that log.

[Fiendforeva]

No, I wasn't in safe mode, But I have tinkered with my computer alot, removed this and that, disabled and whatnot...Havn't had problems so far. and from my first post I have ran spybot search and destroy, Adaware, and registry mechanic, so they might of found some of the problems. but i still have a nasty spyware making very hard navigate the web :sad:

[frenemy]

Try using the following programs:

Ewido
CounterSpy
TrojanHunter
Ad-Aware

Make sure to get the latest definitions/updates for these and run these in Safe Mode.

[Fiendforeva]

I just rebooted normally, not in safe mode, closed all explorer windows, and all programs, scanned again, and the logfile came out identical. =\ I hope i havn't removed something i shouldn't have :o Mainly i was just trying to clean useless stuff up, and get rid of annoying startup programs and the like.

[frenemy]

For that, please use CCleaner

[DMR]

Mainly i was just trying to clean useless stuff up, and get rid of annoying startup programs and the like.

OK- I just needed to check; that's the shortest log I've ever seen from an XP system.

That said, every single entry in the log except the last one indicates the "about:blank" infection. Please follow the removal instructions in my first post in this thread, and give us a new log after that.

[Fiendforeva]

Allllright, I beleive I did everything correctly, and here is the logfile I was left with.

Logfile of HijackThis v1.99.1
Scan saved at 5:00:35 PM, on 7/11/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Jeff Holder.JEFFSCOMP\Desktop\highjack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\JEFFHO~1.JEF\LOCALS~1\Temp\se.dll/spage.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\JEFFHO~1.JEF\LOCALS~1\Temp\se.dll/spage.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O18 - Filter: text/html - {BB19CEC2-134E-499A-BBC6-ABC7A0315BDC} - (no file)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[DMR]

Better, but not by much.

1. Please download this additional "Temp\se.dll" removal tool. Run the utility and click on the "start disinfection" button to initiate the removal procedure.

2. Run HJT again and have it fix the following entries if they still exist:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\JEFFHO~1.JEF\LOCALS~1\Temp\se.dll/spage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\DOCUME~1\JEFFHO~1.JEF\LOCALS~1\Temp\se.dll/spage.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O18 - Filter: text/html - {BB19CEC2-134E-499A-BBC6-ABC7A0315BDC} - (no file)

3. Reboot, run HJT again, and post a new log.

[Fiendforeva]

Alright, I ran that program, it rebooted, then when i ran hjt i didn't see any of those entries. Heres the log.

Logfile of HijackThis v1.99.1
Scan saved at 9:00:39 PM, on 7/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Jeff Holder.JEFFSCOMP\Desktop\highjack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

[DMR]

Good job- that's a totally clean log now. :)

If the fix really worked, you should now be able to set your IE Start Page to whatever you want (the "hsremove.com" entry is obviously just left over from running hte HSRemove utility).

Let us know if you're still experiencing any problems or if things seem to be working correctly now.

[Fiendforeva]

Yessir, Everything is working perfect now. Thank you guys very much for all the assistance. You have been extremely helpful! :D

[DMR]

You're welcome. glad we could help. :)

[crunchie]

This thread is now closed. If you need it reopened, please send a PM to one of our Mods.

Include the link to the thread and detail why you need it reopened.

If this is not your thread please start a New Topic.