It is currently Tue Oct 20, 2026 10:28 am


hijack this log

Is your PC infected? Is it running slow? Just can't figure out what's making it sluggish? Here is the place to get some help.

Moderators: liljim, Gecko

Post a reply

hijack this log

Postby blackbaro » Tue Jul 13, 2004 7:00 pm

My browser keeps getting forwarded to some page [random].dll file on my hard drive
tried deleting stuff that looked suspicious :

appiv.exe,appsm keeps getting back
the rest i deleted stays away (as sdksdk.exe, and more.. )

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\WINDOWS\System32\r_server.exe
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\systy32.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\WINDOWS\System32\sistray.EXE
C:\WINDOWS\system32\ntgp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINDOWS\twain_32\A4CIS600\WATCH.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\taskmgr.exe
C:\totalcmd\TOTALCMD.EXE
c:\michael\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\msizz.dll/sp.html#37049
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://msizz.dll/index.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://msizz.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\msizz.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://msizz.dll/index.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\msizz.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.pandora.be:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {AD4D75B9-68DD-52FB-F33A-64E5C0E44B5B} - C:\WINDOWS\system32\ieae32.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\System32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [mfcoz32.exe] C:\WINDOWS\system32\mfcoz32.exe
O4 - HKLM\..\Run: [appsm.exe] C:\WINDOWS\system32\appsm.exe
O4 - HKLM\..\Run: [ntgp.exe] C:\WINDOWS\system32\ntgp.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKLM\..\RunOnce: [appiv.exe] C:\WINDOWS\system32\appiv.exe
O4 - HKLM\..\RunOnce: [javacv.exe] C:\WINDOWS\javacv.exe
O4 - HKLM\..\RunOnce: [sdkon.exe] C:\WINDOWS\sdkon.exe
O4 - HKLM\..\RunOnce: [apibn.exe] C:\WINDOWS\apibn.exe
O4 - HKLM\..\RunOnce: [sdksu32.exe] C:\WINDOWS\sdksu32.exe
O4 - HKLM\..\RunOnce: [systy32.exe] C:\WINDOWS\systy32.exe
O4 - HKLM\..\RunOnce: [ntda32.exe] C:\WINDOWS\ntda32.exe
O4 - HKLM\..\RunOnce: [ntdc32.exe] C:\WINDOWS\ntdc32.exe
O4 - HKLM\..\RunOnce: [atlvf32.exe] C:\WINDOWS\atlvf32.exe
O4 - HKLM\..\RunOnce: [appru32.exe] C:\WINDOWS\system32\appru32.exe
O4 - HKLM\..\RunOnce: [apinp32.exe] C:\WINDOWS\system32\apinp32.exe
O4 - Startup: Watch.lnk = C:\WINDOWS\twain_32\A4CIS600\WATCH.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Onderzoek (HKLM)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeupdat ... t/opuc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shoc ... wflash.cab
User avatar
blackbaro
Newbie
Newbie
 
Posts: 5
Joined: Wed Jul 14, 2004 1:00 am

Thanks given:0
Thanks received:0
Top

Postby liljim » Tue Jul 13, 2004 8:41 pm

Please post your entire logfile

--------------------------------------------------------------
EX:
Logfile of HijackThis v1.98.0
Scan saved at 9:22:57 PM, on 7/12/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
--------------------------------------------------------------

This part is also important,it lets us know what OS your running and if its up to date.
User avatar
liljim
Moderator
Moderator
 
Posts: 3017
Joined: Mon Mar 03, 2003 1:00 am
Location: Louisiana
Operating System:

Thanks given:0
Thanks received:12
Top

Postby blackbaro » Tue Jul 13, 2004 8:57 pm

ok here he is:
Logfile of HijackThis v1.98.0
Scan saved at 22:03:49, on 13/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\PROGRA~1\NORTON~1\NORTON~4\GHOSTS~2.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\WINDOWS\systy32.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
C:\WINDOWS\crhf32.exe
C:\WINDOWS\System32\sistray.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\totalcmd\TOTALCMD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
c:\michael\HijackThis.exe
c:\michael\hijack this\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\cevps.dll/sp.html#12802
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://cevps.dll/index.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://cevps.dll/index.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\cevps.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\cevps.dll/sp.html#12802
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://cevps.dll/index.html#12802
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.pandora.be:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {02CC75F3-8484-D1DD-2BFB-DC68547A67BA} - C:\WINDOWS\system32\netjj.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {44E45869-432D-7E42-D253-048EAF61F303} - C:\WINDOWS\system32\appsm.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
O4 - HKLM\..\Run: [SiS Tray] C:\WINDOWS\System32\sistray.EXE
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [appsm.exe] C:\WINDOWS\system32\appsm.exe
O4 - HKLM\..\Run: [crhf32.exe] C:\WINDOWS\crhf32.exe
O4 - HKLM\..\RunOnce: [sdksu32.exe] C:\WINDOWS\sdksu32.exe
O4 - HKLM\..\RunOnce: [systy32.exe] C:\WINDOWS\systy32.exe
O4 - HKLM\..\RunOnce: [ntda32.exe] C:\WINDOWS\ntda32.exe
O4 - HKLM\..\RunOnce: [ntdc32.exe] C:\WINDOWS\ntdc32.exe
O4 - HKLM\..\RunOnce: [atlvf32.exe] C:\WINDOWS\atlvf32.exe
O4 - HKLM\..\RunOnce: [appru32.exe] C:\WINDOWS\system32\appru32.exe
O4 - HKLM\..\RunOnce: [apinp32.exe] C:\WINDOWS\system32\apinp32.exe
O4 - HKLM\..\RunOnce: [addis.exe] C:\WINDOWS\addis.exe
O4 - HKLM\..\RunOnce: [javauo32.exe] C:\WINDOWS\system32\javauo32.exe
O4 - HKLM\..\RunOnce: [msvp.exe] C:\WINDOWS\system32\msvp.exe
O4 - HKLM\..\RunOnce: [winfc.exe] C:\WINDOWS\winfc.exe
O4 - HKLM\..\RunOnce: [winho32.exe] C:\WINDOWS\system32\winho32.exe
O4 - HKLM\..\RunOnce: [netsi.exe] C:\WINDOWS\netsi.exe
O4 - HKLM\..\RunOnce: [apicm.exe] C:\WINDOWS\apicm.exe
O4 - HKLM\..\RunOnce: [sysdy32.exe] C:\WINDOWS\system32\sysdy32.exe
O4 - HKLM\..\RunOnce: [adddb.exe] C:\WINDOWS\adddb.exe
O4 - HKLM\..\RunOnce: [ntri.exe] C:\WINDOWS\system32\ntri.exe
O4 - HKLM\..\RunOnce: [appui32.exe] C:\WINDOWS\appui32.exe
O4 - HKLM\..\RunOnce: [mfcul32.exe] C:\WINDOWS\system32\mfcul32.exe
O4 - HKLM\..\RunOnce: [ntks32.exe] C:\WINDOWS\system32\ntks32.exe
O4 - HKLM\..\RunOnce: [mfcrm.exe] C:\WINDOWS\mfcrm.exe
O4 - HKLM\..\RunOnce: [ipnk.exe] C:\WINDOWS\system32\ipnk.exe
O4 - HKLM\..\RunOnce: [atlfd.exe] C:\WINDOWS\atlfd.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Onderzoek - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2004 ... scan53.cab

[edit] i used an older version, now it's the 1.98 version log
Last edited by blackbaro on Tue Jul 13, 2004 9:07 pm, edited 1 time in total.
User avatar
blackbaro
Newbie
Newbie
 
Posts: 5
Joined: Wed Jul 14, 2004 1:00 am

Thanks given:0
Thanks received:0
Top

Postby blackbaro » Tue Jul 13, 2004 9:01 pm

i got desperate and i deleted ALL the runonce and run entries and the appsm.dll(BHO) and then i shut down my computer by pressing the ON/OFF hardware button.
When my computer had rebooted and i ran hijack this, all the runonce and run entries were restored :mad:
User avatar
blackbaro
Newbie
Newbie
 
Posts: 5
Joined: Wed Jul 14, 2004 1:00 am

Thanks given:0
Thanks received:0
Top

Postby brad » Tue Jul 13, 2004 9:31 pm

If you've rebooted since this HJT Log this may not work.

Press Ctrl/Alt/Del and "End Task" or "End Process" on each of the following: (They may or may not be there)

systy32.exe
crhf32.exe

Turn off System Restore. (Turn it back on after this is repaired and you've rebooted.)
(This would also include the “GoBack” Program if it is installed.)
Close all other open Windows and have HiJackThis Fix:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zhpcm.dll/sp.html#12802
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://zhpcm.dll/index.html#12802
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://zhpcm.dll/index.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zhpcm.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://zhpcm.dll/index.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\zhpcm.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.pandora.be:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {44E45869-432D-7E42-D253-048EAF61F303} - C:\WINDOWS\system32\appsm.dll
O4 - HKLM\..\Run: [appsm.exe] C:\WINDOWS\system32\appsm.exe
O4 - HKLM\..\RunOnce: [sdksu32.exe] C:\WINDOWS\sdksu32.exe
O4 - HKLM\..\RunOnce: [systy32.exe] C:\WINDOWS\systy32.exe
O4 - HKLM\..\RunOnce: [ntda32.exe] C:\WINDOWS\ntda32.exe
O4 - HKLM\..\RunOnce: [ntdc32.exe] C:\WINDOWS\ntdc32.exe
O4 - HKLM\..\RunOnce: [atlvf32.exe] C:\WINDOWS\atlvf32.exe
O4 - HKLM\..\RunOnce: [appru32.exe] C:\WINDOWS\system32\appru32.exe
O4 - HKLM\..\RunOnce: [apinp32.exe] C:\WINDOWS\system32\apinp32.exe
O4 - HKLM\..\RunOnce: [addis.exe] C:\WINDOWS\addis.exe
O4 - HKLM\..\RunOnce: [javauo32.exe] C:\WINDOWS\system32\javauo32.exe
O4 - HKLM\..\RunOnce: [msvp.exe] C:\WINDOWS\system32\msvp.exe
O4 - HKLM\..\RunOnce: [winfc.exe] C:\WINDOWS\winfc.exe
O4 - HKLM\..\RunOnce: [winho32.exe] C:\WINDOWS\system32\winho32.exe
O4 - HKLM\..\RunOnce: [netsi.exe] C:\WINDOWS\netsi.exe
O4 - HKLM\..\RunOnce: [apicm.exe] C:\WINDOWS\apicm.exe
O4 - HKLM\..\RunOnce: [sysdy32.exe] C:\WINDOWS\system32\sysdy32.exe
O4 - HKLM\..\RunOnce: [adddb.exe] C:\WINDOWS\adddb.exe
O4 - HKLM\..\RunOnce: [ntri.exe] C:\WINDOWS\system32\ntri.exe
O4 - HKLM\..\RunOnce: [appui32.exe] C:\WINDOWS\appui32.exe
O4 - HKLM\..\RunOnce: [mfcul32.exe] C:\WINDOWS\system32\mfcul32.exe
O4 - HKLM\..\RunOnce: [ntks32.exe] C:\WINDOWS\system32\ntks32.exe
O4 - HKLM\..\RunOnce: [mfcrm.exe] C:\WINDOWS\mfcrm.exe
O4 - HKLM\..\RunOnce: [ipnk.exe] C:\WINDOWS\system32\ipnk.exe
O4 - HKLM\..\RunOnce: [atlfd.exe] C:\WINDOWS\atlfd.exe
O4 - Global Startup: GStartup.lnk = C:\Program Files\Common Files\GMT\GMT.exe


Go to Control Panel / Add/Remove Programs and remove the following if they are there:

GMT
Gator

Now delete these Folders or Files that are Highlighted: (You may need enable "Show all Files" and disable "Hide System Files" in Windows Explorer / Tools / Folder Options / View Tab) (You may have to boot to "Safe Mode" in order to delete some Files/Folders)

C:\WINDOWS\system32\appsm.dll
C:\Program Files\Common Files\GMT
C:\WINDOWS\zhpcm.dll
C:\WINDOWS\sdksu32.exe
C:\WINDOWS\systy32.exe
C:\WINDOWS\ntda32.exe
C:\WINDOWS\ntdc32.exe
C:\WINDOWS\atlvf32.exe
C:\WINDOWS\system32\appru32.exe
C:\WINDOWS\system32\apinp32.exe
C:\WINDOWS\addis.exe
C:\WINDOWS\system32\javauo32.exe
C:\WINDOWS\system32\msvp.exe
C:\WINDOWS\winfc.exe
C:\WINDOWS\system32\winho32.exe
C:\WINDOWS\netsi.exe[/b]
C:\WINDOWS\apicm.exe
C:\WINDOWS\system32\sysdy32.exe
C:\WINDOWS\adddb.exe
C:\WINDOWS\system32\ntri.exe
C:\WINDOWS\appui32.exe
C:\WINDOWS\system32\mfcul32.exe
C:\WINDOWS\system32\ntks32.exe
C:\WINDOWS\mfcrm.exe
C:\WINDOWS\system32\ipnk.exe
C:\WINDOWS\atlfd.exe
C:\WINDOWS\zhpcm.dll

Now, empty all your TEMP Folders (WinXp has up to 4 of them) / Temporary Internet Files Folder and then empty your "Recycle Bin" and reboot.

brad
brad
Geek Alumni
 
Posts: 2079
Joined: Sat Jul 19, 2003 1:00 am
Location: Charlotte, NC

Thanks given:0
Thanks received:0
Top
Post a reply

Return to Malware Support

Who is online

Users browsing this forum: No registered users and 1 guest

cron