Hijackthis log file,

jsatur

unread,

Oct 11, 2008, 12:45:46 PM10/11/08

to

Here's my log file. Could someone let me know if there is anything that
needs fixing. Thanks,
Jenn

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:08:30 PM, on 10/5/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\system32\schtasks.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\PeoplePC\ISP6630\Browser\Bartshel.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Windows\system32\jusched.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Sharpcast\Photos\sharpcast_photos.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\PeoplePC\ISP6630\Browser\PPShared.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\att-nap\McciBrowser.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Todd\AppData\Roaming\U3\1101420CBF0336A8\LaunchPad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://home.peoplepc.com/search
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL
= http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
http://home.peoplepc.com/search
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName
=
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D}
- C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
O1 - Hosts: ::1 localhost
O2 - BHO: EarthLink BHO Guard - {00000000-0000-0000-0000-000000000002}
- C:\Program Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: MyWebSearch Search Assistant BHO -
{00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program
Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL
O2 - BHO: &Yahoo! Toolbar Helper -
{02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program
Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper -
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common
Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: EarthLink ScamBlocker V3 -
{15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program
Files\PeoplePC\Toolbar\ScamGrd.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no
file)
O2 - BHO: Accelerator Plugin - {656EC4B7-072B-4698-B504-2A414C1F0037} -
C:\PROGRA~1\PEOPLE~1\PRPL_I~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -
C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} -
c:\program files\peoplepc\toolbar\ppctoolbar.dll
O2 - BHO: Google Toolbar Helper -
{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program
files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO -
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program
Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -
C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no
file)
O3 - Toolbar: PeoplePal Toolbar -
{A8FB8EB3-183B-4598-924D-86F0E5E37085} - c:\program
files\peoplepc\toolbar\ppctoolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -
c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows
Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program
Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler]
[ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program
Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateReg] "C:\Windows\system32\jureg.exe"
O4 - HKLM\..\Run: [Bart Station] C:\Program
Files\PeoplePC\ISP6630\BIN\PPCOLink.exe -STATION
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir
PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software
Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE
C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE
C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows
Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP
Advisor\HPAdvisor.exe autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Yahoo! Pager]
"C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN
Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows
Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe
oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows
Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: Sharpcast Photos.lnk = C:\Program
Files\Sharpcast\Photos\sharpcast_photos.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program
Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Send to OneNote -
{2670000A-7350-4f3c-8081-5663EE0C6C49} -
C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote -
{2670000A-7350-4f3c-8081-5663EE0C6C49} -
C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger -
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program
Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger -
{E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program
Files\Yahoo!\Messenger\YahooMessenger.exe
O13 - Gopher Prefix:
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Fun Web Products
Installer Start) -
http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-3/PopularScreenSaversFWBInitialSetup1.0.1.0.cab
O16 - DPF: {3CF32649-D1C0-4F42-AB44-ED284748920B} (Merriam-Webster
Online Toolbar) -
http://www.merriam-webster.com/downloads/toolbar/webinstall.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner
Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) -
http://www.nick.com/common/groove/gx/GrooveAX27.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler
(AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir
PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) -
Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition
Classic\avguard.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program
Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program
Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program
Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: LightScribeService Direct Disc Labeling Service
(LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common
Files\LightScribe\LSSrvc.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program
Files\Common Files\Motive\McciCMService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. -
C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9236 bytes

--
jsatur
------------------------------------------------------------------------
jsatur's Profile: http://forums.techarena.in/members/jsatur.htm
View this thread: http://forums.techarena.in/security-home-users/1053151.htm

http://forums.techarena.in

Malke

unread,

Oct 11, 2008, 2:58:57 PM10/11/08

to

jsatur wrote:

>
> Here's my log file. Could someone let me know if there is anything that
> needs fixing. Thanks,

(snip HJT log)

I'm sorry but we don't analyze HJT logs here in the MS newsgroups. It takes
a great deal of time and expertise to do this and you won't get the
attention you need here. Instead, choose one of the following specialty
forums, register, and read their posting FAQ.

http://aumha.org/downloads/hijackthis.zip
http://aumha.net/ - Click on the HijackThis forum. Read the announcement and
the stickies *first*.
http://www.atribune.org/forums/index.php?showforum=9
http://aumha.net/viewforum.php?f=30
http://www.bleepingcomputer.com/forums/forum22.html
http://www.dslreports.com/forum/cleanup
http://www.cybertechhelp.com/forums/forumdisplay.php?f=25
http://www.geekstogo.com/forum/Malware_Removal_HiJackThis_Logs_Go_Here-f37.html
http://www.malwarebytes.org/forums/index.php?showforum=7
http://gladiator-antivirus.com/forum/index.php?showforum=170
http://spywarewarrior.com/viewforum.php?f=5
http://forums.techguy.org/54-security/
http://forums.tomcoyote.org/
http://www.thespykiller.co.uk/index.php?board=3.0
http://forums.subratam.org/index.php?showforum=7

Malke
--
MS-MVP
Elephant Boy Computers - Don't Panic!
FAQ - http://www.elephantboycomputers.com/#FAQ

~BD~

unread,

Oct 12, 2008, 2:52:05 AM10/12/08

to

Hello Jenn

If you go to www.hijackthis.de and paste in your HJT log file you will
receive an 'auto' response. I've already done so with the one you posted
here and the results are ..... 'interesting' shall I say! It appears that
quite a lot of things need fixing!

You are probably best advised to follow the advice already given by Malke.

Good luck!

Dave

--

"jsatur" <jsatur...@DoNotSpam.com> wrote in message
news:jsatur...@DoNotSpam.com...

>
> Here's my log file. Could someone let me know if there is anything that
> needs fixing. Thanks,
> Jenn

<snip>

imbeady2

unread,

Oct 12, 2008, 5:02:54 AM10/12/08

to

~BD~;4021044 Wrote:
> Hello Jenn
>
> If you go to www.hijackthis.de and paste in your HJT log file you will
> receive an 'auto' response. I've already done so with the one you
> posted
> here and the results are ..... 'interesting' shall I say! It appears
> that
> quite a lot of things need fixing!
>
> You are probably best advised to follow the advice already given by
> Malke.
>
> Good luck!
>
> Dave
>
> --
>
>
>

HOW COULD THIS MESSAGE HAVE POSSIBLY ARRIVED HERE ON THIS FORUM?

I personally posted same (using ~BD~ as my username) using Outlook
Express and the microsoft.public.security.homeusers newsgroup

This is a mystery!

Can anyone help me to solve it? TIA

Dave

--

--
imbeady2
------------------------------------------------------------------------
imbeady2's Profile: http://forums.techarena.in/members/imbeady2.htm
View this thread: http://forums.techarena.in/security-home-users/1053152.htm

http://forums.techarena.in

BoaterDave

unread,

Oct 12, 2008, 6:42:28 AM10/12/08

to

On 12 Oct, 10:02, imbeady2 <imbeady2.3h5...@DoNotSpam.com> wrote:
> ~BD~;4021044 Wrote:

> HOW COULD THIS MESSAGE HAVE POSSIBLY ARRIVED HERE ON THIS FORUM?
>
> I personally posted same (using ~BD~ as my username) using Outlook
> Express and the microsoft.public.security.homeusers newsgroup
>
> This is a mystery!
>
> Can anyone help me to solve it? TIA
>
> Dave
>
> --
>
> --
> imbeady2
> ------------------------------------------------------------------------
> imbeady2's Profile:http://forums.techarena.in/members/imbeady2.htm
> View this thread:http://forums.techarena.in/security-home-users/1053152.htm
>

> http://forums.techarena.in- Hide quoted text -
>
> - Show quoted text -

The message shown above was posted, by me, using my username
'imbeady2'. It was made from the Techarena forum.

It has now appeared in the newsgroup
'microsoft.public.security.homeusers' which I currently access via
Outlook Express 6. I'm now responding from Google Groups (where it
also appears) - I expect, based on past experience, *this* message to
appear in the same newsgroup in OE6 - but under my username of
BoaterDave.

There is apparently a connection between Techarena and the other
usenet groups. I should be most grateful if someone can clarify same
for me.

My thanks in anticipation!

Dave

PA Bear [MS MVP]

unread,

Oct 12, 2008, 11:34:05 AM10/12/08

to

Leonard Grey

unread,

Oct 12, 2008, 12:02:01 PM10/12/08

to

Nice try. <plonk>
---
Leonard Grey
Errare humanum est

"A Day in the Life of a Web 2.0 Hacker" - PC Magazine
http://www.pcmag.com/article2/0,2817,2330952,00.asp

~BD~

unread,

Oct 12, 2008, 1:04:35 PM10/12/08

to

"PA Bear [MS MVP]" <PABe...@gmail.com> wrote in message
news:e$co3AILJ...@TK2MSFTNGP04.phx.gbl...
<snip>

Your response does not help me, Mr Robear Dyer! :(

This was (is) a serious query.

I post using OE6 in news.microsoft.com with the username ~BD~

I post using Google Groups with the username BoaterDave

I posted in the Techarena Forum using my registered name there - 'imbeady2'

Perhaps the question is too difficult for 'advisers' here to answer. I had
thought there might have been a simple explanation but it seems that this is
not so!

Dave

~BD~

unread,

Oct 12, 2008, 1:22:20 PM10/12/08

to

"Leonard Grey" <l.g...@invalid.invalid> wrote in message
news:eGXNVPI...@TK2MSFTNGP03.phx.gbl...
> Nice try.> ---

> Leonard Grey
> Errare humanum est

Interestingly - to me, anyway, your response and that of PA Bear, are also
now captured in the Techarena Forum, here:-
http://forums.techarena.in:80/security-home-users/1053152.htm

My query remains - how and why are they showing in that Forum when
(presumably) they were posted in the Microsoft groups?

Dave

--

Shenan Stanley

unread,

Oct 12, 2008, 1:46:29 PM10/12/08

to

<snip>

~BD~ wrote:
> Interestingly - to me, anyway, your response and that of PA Bear,
> are also now captured in the Techarena Forum, here:-
> http://forums.techarena.in:80/security-home-users/1053152.htm
>
> My query remains - how and why are they showing in that Forum when
> (presumably) they were posted in the Microsoft groups?

Unless you plan on doing it yourself - I wouldn't over-think it.

The owners of said forum(s) in question have decided to programmatically
synchronize the newsgroups/their forums in this manner and/or directly
access the newsgroups through scripts and such...

Only the owners of said forum would know what they were doing and why
(thus - your answer is, "Ask the owners of said forum how it works and if
they feel so inclined - they may answer you." --
http://forums.techarena.in/sendmessage.php )

You realize your postings here are likely propogated to hundreds, thousands
even, of newsgroups and forums around the world - right?

BTW - hijacking a conversation such as this one - likely not a poilte (or
helpful) move towards the original poster.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

BurfordTJustice

unread,

Oct 12, 2008, 2:24:18 PM10/12/08

to

U R A Fraud

"imbeady2" <imbeady...@DoNotSpam.com> wrote in message
news:imbeady...@DoNotSpam.com...

~BD~;4021044 Wrote:
>
> Dave

jen

unread,

Oct 12, 2008, 2:25:56 PM10/12/08

to

"~BD~" <Boate...@nospam.invalid> wrote in message
news:%23153iyI...@TK2MSFTNGP02.phx.gbl...

Web-to-Usenet Gateways:
http://www.usenet.com.au/about/content.php?page=35

-jen

~BD~

unread,

Oct 12, 2008, 2:35:29 PM10/12/08

to

"Shenan Stanley" <newsh...@gmail.com> wrote in message
news:eKieKKJL...@TK2MSFTNGP04.phx.gbl...
<snip>

> Unless you plan on doing it yourself - I wouldn't over-think it.

I'm afraid I do not understand what you mean by this, Shenan. If you have
the time, please expand. TIA

> The owners of said forum(s) in question have decided to programmatically
> synchronize the newsgroups/their forums in this manner and/or directly
> access the newsgroups through scripts and such...
>
> Only the owners of said forum would know what they were doing and why
> (thus - your answer is, "Ask the owners of said forum how it works and if
> they feel so inclined - they may answer you." --
> http://forums.techarena.in/sendmessage.php )

Thank you for the link and your suggestion. I have contacted the Webmaster
accordingly.

> You realize your postings here are likely propogated to hundreds,
> thousands even, of newsgroups and forums around the world - right?

Not really - but I wouldn't be at all surprised!

> BTW - hijacking a conversation such as this one - likely not a poilte (or
> helpful) move towards the original poster.

I understand what you are implying, Shenan, but I'm sure you also recognise
that, in the first instance, I tried to make a contribution which the OP may
just have found helpful.

You are one of the few 'helpers' here whom I trust and respect. Thank you
for your comments.

Dave

--

~BD~

unread,

Oct 12, 2008, 2:58:51 PM10/12/08

to

"jen" <j...@example.com> wrote in message
news:%23Qyt7fJ...@TK2MSFTNGP02.phx.gbl...

Thank you for that 'pointer' -jen. I read all the information provided there
with interest.

Perhaps I must simply assume that Techarena somewhat 'abuses' a relatively
simple Usenet system.Perhaps their webmaster will respond to my query in due
course. I'll let folk here know!

My experience has been complicated because at home I subscribe to AOL as my
ISP. AOL(uk) do not provide direct access to Newsgroups at all and refer all
users to Google Groups for access. Whilst on my narrowboat, however, I am
now using a new Mobile Broadband service through a UK based 'phone company
called 'Three'. I use OE6 for linking in to Newsgroups with this connection.

Dave

--