Home > Hijack This > Hijack This Log For Checking Please

Hijack This Log For Checking Please

I assume you have or have had them installed at one time. Drive 0 Scanning MBR on drive 0... Motherboard: Dell Inc. | | 0WG261 Processor: Intel(R) Pentium(R) 4 CPU 3.00GHz | Microprocessor | 2992/800mhz . ==== Disk Partitions ========================= . rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/ iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/ Restart computer in safe mode Double-click on the Rkill desktop icon to run the tool. this contact form

KG - C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE O23 - Service: Apache - Apache Software Foundation - C:\zpanel\bin\apache\bin\httpd.exe O23 - Service: Ask Update Service (APNMCP) - APN LLC. - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe O23 I have followed your instruction and here are my logs as requested:- Malwarebytes Anti-Malware www.malwarebytes.org Database version: v2013.06.21.08 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Mike :: HKCR\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} (PUP.Software.Updater) -> Quarantined and deleted successfully. Removing c:\documents and settings\all users\application data\malwarebytes' anti-malware (portable)\mbr_0_r.mbam... https://forums.malwarebytes.com/topic/67285-hijackthis-log-for-checking-please/?do=email&comment=344988

Scan finished ======================================= Removal queue found; removal started Removing c:\documents and settings\all users\application data\malwarebytes' anti-malware (portable)\mbr_0_i.mbam... They can conflict with each other.Edit for clarity Edited by dsilvers - 06 December 2009 at 9:20pm Bomb123 Members Profile Send Private Message Find Members Posts Add to Buddy List Senior Name: VMware Virtual Ethernet Adapter for VMnet1 PNP Device ID: ROOT\VMWARE\0000 Service: VMnetAdapter . ==== System Restore Points =================== . Anyways i had nothing to do with it.

All rights reserved.Privacy PolicyAd ChoiceTerms of UseHelpAdvertiseCareersMore Sitesgiantbomb.comgamefaqs.commetacritic.comgamerankings.comReviewsLatest ReviewsPCPS4Xbox OneSwitchNewsLatest NewsPCPS4Xbox OneSwitchShowsBattlefield AcademyGameSpot NewsThe LobbyNew ReleasesScreen/PlayCommunityForumsCommunity Blog facebook.com/gamespot twitter.com/gamespot youtube.com/gamespot RSSGameSpot Game of the Week Use your keyboard!ESCLog in to comment HKCR\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476} (PUP.Software.Updater) -> Quarantined and deleted successfully. Please check my HijackThis log and advise.... If the connection is not there use restore point you created prior to running Combofix.

You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus. Many of the same wierd services running from a temp file. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can have a peek here Wait while the system shuts down and the cleanup process is performed.

or read our Welcome Guide to learn how to use this site. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site. Removing c:\documents and settings\all users\application data\malwarebytes' anti-malware (portable)\mbr_2_i.mbam... Join the community here, it only takes a minute.

Finished : << RKreport[0]_D_06222013_113020.txt >> RKreport[0]_S_06222013_112841.txt Malwarebytes Anti-Rootkit BETA www.malwarebytes.org Database version: v2013.06.22.02 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Mike :: HAWAII [administrator] 22/06/2013 11:36:32 mbar-log-2013-06-22 FileExt: .txt: txtfile=C:\Windows\System32\NOTEPAD.EXE %1 [UserChoice] FileExt: .vbs: bfvbsfile="C:\Program Files (x86)\Bluefish\bluefish.exe" "%1" FileExt: .js: bfjsfile="C:\Program Files (x86)\Bluefish\bluefish.exe" "%1" ShellExec: Opera.exe: open="C:\Program Files (x86)\Opera\Launcher.exe" "%1" . =============== Created Last 30 ================ . 2014-01-13 OK! +++++ PhysicalDrive1: ST3160828AS +++++ --- User --- [MBR] f56dccb48df69924d7e6677e2c70b3e4 [BSP] 514b03b8f59a3a2bcedcd7310f308361 : Windows XP MBR Code Partition table: 0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 1907726 If Combofix asks you to install Recovery Console, please allow it.

Back to top #4 AndreasNHagen AndreasNHagen Topic Starter Members 25 posts OFFLINE Local time:10:08 AM Posted 14 January 2014 - 04:43 PM The reason why I think there is a weblink Your mistakes during cleaning process may have very serious consequences, like unbootable computer. Several functions may not work. If I don't miss my guess they are mostly left overs from rkr.

The program properties says it belongs to the avz tool. Wait until the Status box shows Scan Finished Click on Delete. Already have an account? http://pcialliance.org/hijack-this/hijack-this-log-and-strange-file-names-need-checking.html Some appear related to DR web and lavasoft.

HKCR\CLSID\{E856B973-45FD-4559-8F82-EAB539144667} (Adware.Gdown) -> Quarantined and deleted successfully. Trying to follow instructions from multiple sources will just confuse you.For the record I don't see anything malicious. E: is CDROM () F: is CDROM () . ==== Disabled Device Manager Items ============= .

IFEO: bitguard.exe - tasklist.exe IFEO: bprotect.exe - tasklist.exe IFEO: bpsvc.exe - tasklist.exe IFEO: browsemngr.exe - tasklist.exe IFEO: browserdefender.exe - tasklist.exe IFEO: browsermngr.exe - tasklist.exe IFEO: browserprotect.exe - tasklist.exe IFEO: browsersafeguard.exe -

It could be that the virus chaser were malicious or something because there were for example the f-secure detection in the downloaded program files... Partition starts at LBA: 128520 Numsec = 302616405 Partition file system is NTFS Partition is bootable Partition 2 type is Other (0xdb) Partition is NOT ACTIVE. Running slow May 18, 2005 Can someone please check my HijackThis log? HKCR\GTDOWNDE.GTAutoFixDLCtrl.1 (Adware.Gdown) -> Quarantined and deleted successfully.

Partition starts at LBA: 2048 Numsec = 3907022848 Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Keep updating me regarding your computer behavior, good, or bad. Ask a Question See Latest Posts TechSpot Forums are dedicated to computer enthusiasts and power users. his comment is here C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\Hpservice.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\System32\spoolsv.exe C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program

Did you see any malicious in the log? Bomb123 Members Profile Send Private Message Find Members Posts Add to Buddy List Senior Member Joined: 13 October 2009 Status: Offline Points: 136 Post Options Post Reply QuoteBomb123 Report Post IF REQUESTED, ZIP IT UP & ATTACH IT . Bomb123 Members Profile Send Private Message Find Members Posts Add to Buddy List Senior Member Joined: 13 October 2009 Status: Offline Points: 136 Post Options Post Reply QuoteBomb123 Report Post

The list is not all inclusive. C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\FolderSize\FolderSizeSvc.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Ralink\Common\RaRegistry.exe C:\Program Files\Serviio\bin\ServiioService.exe C:\Program Files\Serviio\bin\ServiioService.exe C:\WINDOWS\System32\StkASv2K.exe C:\WINDOWS\ehome\mcrdsvc.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Google\Update\GoogleUpdate.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\stsystra.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe Please refer to Attach.txt . ================= FIREFOX =================== .