Hijack This! logs

Steve · February 21, 2006

You've missed virtually everything I said to delete dood.

Pman · February 21, 2006

i did what u said myabe its just not ment to be

:((

Pman · February 21, 2006

ill try again

Pman · February 21, 2006

Logfile of HijackThis v1.99.1

Scan saved at 18:28:07, on 21/02/2006

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Program Files\Microsoft Hardware\Mouse\point32.exe

C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\Documents and Settings\Paul Holness\My Documents\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/

F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [POINTER] point32.exe

O4 - HKLM\..\Run: [Windows Word] WINWORD32.EXE

O4 - HKLM\..\Run: [speedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon

O4 - HKLM\..\Run: [Ad-Aware] "C:\PROGRA~1\LAVASOFT\AD-AWA~2\AD-AWARE.EXE" +c

O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [speedTouchstInstall] "C:/Documents and Settings/Paul Holness/Desktop/SetupWizard/stInstall.exe"

O4 - Startup: Karoo.lnk = D:\Start.exe

O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm

O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm

O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm

O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm

O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm

O8 - Extra context menu item: Open All Links in This Page... - C:\Program Files\Avant Browser\OpenAllLinks.htm

O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm

O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O17 - HKLM\System\CCS\Services\Tcpip\..\{2F1876E1-25BE-4089-9173-4933F8F30001}: NameServer = 212.50.160.100 213.249.130.100

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~2\msgrapp.dll" (file missing)

O20 - Winlogon Notify: debugg - C:\WINDOWS\SYSTEM32\debugg.dll

O21 - SSODL: WebCheck - {E61B5E20-DE35-11CF-9C87-1579005127ED} - (no file)

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: iPod Service (iPodService) - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)

O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: SmartLinkService (SLService) - Unknown owner - slserv.exe (file missing)

Pman · February 21, 2006

most of them wont go

Steve · February 21, 2006

That's better man. You need to fix these: -

O20 - Winlogon Notify: debugg - C:\WINDOWS\SYSTEM32\debugg.dll

O21 - SSODL: WebCheck - {E61B5E20-DE35-11CF-9C87-1579005127ED} - (no file)

And you need to do the Safe Mode part or they'll keep coming back. One is a virus that allows hackers full access to your PC and as you have no firewall to stop them........

You also need to get your Windows Updates man. Service Pack 2 was released months ago and fixes a lot of security issues.

trick · February 21, 2006

Steve - how do I take off email notifications on this thread? Only I'm getting mail every time someone replies now, which I don't really want...

I tried clicking the "track this topic" link, but it only starts tracking, but doesn't stop it...

Pman · February 21, 2006

That's better man. You need to fix these: -

O20 - Winlogon Notify: debugg - C:\WINDOWS\SYSTEM32\debugg.dll
O21 - SSODL: WebCheck - {E61B5E20-DE35-11CF-9C87-1579005127ED} - (no file)

And you need to do the Safe Mode part or they'll keep coming back. One is a virus that allows hackers full access to your PC and as you have no firewall to stop them........

You also need to get your Windows Updates man. Service Pack 2 was released months ago and fixes a lot of security issues.
<{POST_SNAPBACK}>

chhers will do

Pman · February 21, 2006

one more thing i lost the desktop icon it isnt anywhere any ideas how to get it back also my internet explorer icon

Steve · February 21, 2006

Have you turned the Quick Launch toolbar off? Right click the taskbar and have a look - it's under Toolbars.

Pman · February 21, 2006

i got onto safe mode could'nt find tools and folder options. its just like normal but weird.

found debug.dll cant delete it

i got internet explorer icon back but still missing desttop one from quick lauch i deleted it off a while ago cant find away to get it back.

cheers

Edited February 21, 2006 by Pman

Steve · February 21, 2006

OK, well you need to get rid of that debugg.dll file. (Note the 2 letter g's in the name - don't delete any other files with similar names!).

To get rid of it, do this: -

Hit Start, then Run and type "cmd" without quotes and hit Enter. An old DOS style window will open. Type the following commands, pressing enter after each one: -

c:

cd\

cd c:\windows\system32

regsvr32 /u debugg.dll

In the third command there is a single space after "cd" and in the last command there is a single space either side of "/u". Once you've done that, reboot into Safe Mode again and you should be able to delete the file. If you can't post back again, but either way it has to be gotten rid of as it's a trojan.

To restore your Show Desktop icon, download this attachment and unzip the file to your Desktop. Then you can drag it on to the Quick Launch bar: -

Show_Desktop.zip

Pman · February 21, 2006

i got the desktop logo backs thanks alot

i did that thing in what looks like dos, it says the registery point was not found so shall i still go in safe mode

go through step by step what i do in safe mode.

cheers

Steve · February 21, 2006

I tell you what, we'll try it an easier way, because if you didn't get a message saying "the dll has been unregistered" or some shit like that, then chances are you won't be able to delete it in Safe Mode again.

Run HijackThis again and instead of clicking the Scan button, click Config on the right. Click the Misc Tools button at the top, then from the menu on the left select Delete A File On Reboot... Browse to the debugg.dll file and select it. You'll get a message saying it'll be deleted next time you reboot and do you want to do that now - select yes and that should be it.

Pman · February 21, 2006

I tell you what, we'll try it an easier way, because if you didn't get a message saying "the dll has been unregistered" or some shit like that, then chances are you won't be able to delete it in Safe Mode again.

Run HijackThis again and instead of clicking the Scan button, click Config on the right. Click the Misc Tools button at the top, then from the menu on the left select Delete A File On Reboot... Browse to the debugg.dll file and select it. You'll get a message saying it'll be deleted next time you reboot and do you want to do that now - select yes and that should be it.
<{POST_SNAPBACK}>

Right

i done all that ill post my last hijack log

i'll love you forever if its worked just give us a final overlook

Logfile of HijackThis v1.99.1

Scan saved at 22:02:54, on 21/02/2006

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\wuauclt.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\Microsoft Hardware\Mouse\point32.exe

C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe

C:\WINDOWS\System32\ctfmon.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe

C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

C:\Documents and Settings\Paul Holness\My Documents\Downloads\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/

F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe

O2 - BHO: (no name) - {021BB032-80A8-4FB6-B3D5-CF27B1553B95} - (no file)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: (no name) - {2548e425-a332-4c84-9633-4b3101f7d0bb} - (no file)

O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Program Files\GetRight\xx2gr.dll

O2 - BHO: (no name) - {4CFD8060-60C8-45A8-8133-4B086C5AE49F} - (no file)

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - (no file)

O2 - BHO: (no name) - {B9089D79-F34A-7D76-9427-BF5FF9BABCF1} - (no file)

O2 - BHO: (no name) - {D881967C-B832-4DE8-B844-98D9D055C89A} - (no file)