Hijack This Log, Please help

  1. 08-01-2005  #1
    UNCLEBEETS
    UNCLEBEETS is offline Newbie

    Hijack This Log, Please help

    Here is a log from my sisters coputer, she complains of popups and a very slow computer, help her please.




    Logfile of HijackThis v1.99.0
    >Scan saved at 11:51:15 PM, on 1/6/05
    >Platform: Windows 98 SE (Win9x 4.10.2222A)
    >MSIE: Internet Explorer v5.00 (5.00.2614.3500)
    >
    >Running processes:
    >C:\WINDOWS\SYSTEM\KERNEL32.DLL
    >C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    >C:\WINDOWS\SYSTEM\MPREXE.EXE
    >C:\WINDOWS\SYSTEM\mmtask.tsk
    >C:\WINDOWS\SYSTEM\MSTASK.EXE
    >C:\WINDOWS\EXPLORER.EXE
    >C:\WINDOWS\TASKMON.EXE
    >C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    >C:\PROGRAM FILES\AHEAD\INCD\INCD.EXE
    >C:\WINDOWS\LOADQM.EXE
    >C:\WINDOWS\QKSHIELD.EXE
    >C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
    >C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
    >C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
    >C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
    >C:\WINDOWS\SYSTEM\DDHELP.EXE
    >C:\WINDOWS\RUNDLL32.EXE
    >C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
    >C:\PROGRAM FILES\ARES LITE EDITION\ARESLITE.EXE
    >C:\PROGRAM FILES\SPYWARE DOCTOR\SWDOCTOR.EXE
    >C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
    >C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\1033\MSOFFICE.EXE
    >C:\WINDOWS\SYSTEM\WMIEXE.EXE
    >C:\PROGRAM FILES\WINAMP\WINAMP.EXE
    >C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    >C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    >C:\PROGRAM FILES\NOADWARE3\NOADWARE3.EXE
    >C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
    >C:\MY DOCUMENTS\HIJACKTHIS.EXE
    >
    >R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
    >http://g.msn.com/0SEENUS/SAOS01
    >R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
    >http://runonce.msn.com/
    >F1 - win.ini: run=hpfsched
    >O2 - BHO: AcroIEHlprObj Class -
    >{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM
    >FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
    >O2 - BHO: NavHelper Class - {C1E58A84-95B3-4630-B8C2-D06B77B7A0FC} -
    >C:\PROGRAM FILES\NAVEXCEL\NAVHELPER\V2.0.4B\NHELPER.DLL
    >O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -
    >C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
    >O2 - BHO: PCTools Browser Monitor -
    >{B56A7D7D-6927-48C8-A975-17DF180C71AC} -
    >C:\PROGRA~1\SPYWAR~1\TOOLS\IESDPB.DLL
    >O2 - BHO: PCTools Site Guard -
    >{5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} -
    >C:\PROGRA~1\SPYWAR~1\TOOLS\IESDSG.DLL
    >O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} -
    >C:\WINDOWS\SYSTEM\MSDXM.OCX
    >O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    >O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    >O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    >O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe
    >powrprof.dll,LoadCurrentPwrScheme
    >O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE
    >C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
    >O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    >O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
    >O4 - HKLM\..\Run: [InCD] C:\Program Files\ahead\InCD\InCD.exe
    >O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    >O4 - HKLM\..\Run: [QuikShield] qkshield.exe
    >O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    >O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE
    >/STARTUP
    >O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
    >O4 - HKLM\..\Run: [AVG7_AMSVR]
    >C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
    >O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe
    >powrprof.dll,LoadCurrentPwrScheme
    >O4 - HKLM\..\RunServices: [SchedulingAgent]
    >C:\WINDOWS\SYSTEM\mstask.exe
    >O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE
    >C:\WINDOWS\SYSTEM\NVMCTRAY.DLL,NvTaskbarInit
    >O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN
    >Messenger\MsnMsgr.Exe" /background
    >O4 - HKCU\..\Run: [areslite] "C:\PROGRAM FILES\ARES LITE
    >EDITION\ARESLITE.EXE" -h
    >O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware
    >Doctor\swdoctor.exe" /Q
    >O4 - Startup: WinZip Quick Pick.lnk = C:\Program
    >Files\WinZip\WZQKPICK.EXE
    >O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
    >Office\Office\OSA9.EXE
    >O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a}
    >- C:\WINDOWS\web\related.htm
    >O9 - Extra 'Tools' menuitem: Show &Related Links -
    >{c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    >O9 - Extra button: Spyware Doctor -
    >{2D663D1A-8670-49D9-A1A5-4C56B4E14E84} -
    >C:\PROGRA~1\SPYWAR~1\TOOLS\IESDPB.DLL
    >O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
    >O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF}
    >(MsnMessengerSetupDownloadControl Class) -
    >http://messenger.msn.com/download/Ms...Downloader.cab
    >O16 - DPF: {8EF27A70-DD04-11D6-B7F6-00A0C9CD5F8A} -
    >http://www.quikshield.com/qshsetup.exe
    >O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class)
    >- http://zone.msn.com/binFramework/v10...o.cab32846.cab
    >
  2. 09-01-2005  #2
    owen
    owen is offline D-A-L Team Member (UK)
    Go to the Control Panel, double click Add/Remove programs and uninstall NAVHelper. Then post a fresh log.

    Might be better if she posted the logs direclty, skipping the middle man.
  3. 12-01-2005  #3
    NickyBaby
    NickyBaby is offline Newbie
    Hi Owen,

    My brother, UncleBeets had contacted you with my first log. You said it would be best if I sent you my information myself. So, I uninstalled NavHelp and made a new log for you. Here it is....thank you very much
    Nicky

    Logfile of HijackThis v1.99.0
    Scan saved at 4:02:41 PM, on 1/12/05
    Platform: Windows 98 SE (Win9x 4.10.2222A)
    MSIE: Internet Explorer v5.00 (5.00.2614.3500)

    Running processes:
    C:\WINDOWS\SYSTEM\KERNEL32.DLL
    C:\WINDOWS\SYSTEM\MSGSRV32.EXE
    C:\WINDOWS\SYSTEM\MPREXE.EXE
    C:\WINDOWS\SYSTEM\mmtask.tsk
    C:\WINDOWS\SYSTEM\MSTASK.EXE
    C:\WINDOWS\EXPLORER.EXE
    C:\WINDOWS\TASKMON.EXE
    C:\WINDOWS\SYSTEM\SYSTRAY.EXE
    C:\PROGRAM FILES\AHEAD\INCD\INCD.EXE
    C:\WINDOWS\LOADQM.EXE
    C:\WINDOWS\QKSHIELD.EXE
    C:\PROGRAM FILES\WINAMP\WINAMPA.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXE
    C:\PROGRAM FILES\GRISOFT\AVG FREE\AVGAMSVR.EXE
    C:\WINDOWS\RUNDLL32.EXE
    C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
    C:\PROGRAM FILES\ARES LITE EDITION\ARESLITE.EXE
    C:\WINDOWS\SYSTEM\DDHELP.EXE
    C:\PROGRAM FILES\SPYWARE DOCTOR\SWDOCTOR.EXE
    C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
    C:\WINDOWS\RUNDLL32.EXE
    C:\WINDOWS\SYSTEM\WMIEXE.EXE
    C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\1033\MSOFFICE.EXE
    C:\MY DOCUMENTS\HIJACKTHIS.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/
    F1 - win.ini: run=hpfsched
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDPB.DLL
    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDSG.DLL
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
    O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
    O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [QuikShield] qkshield.exe
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
    O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
    O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
    O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
    O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NVMCTRAY.DLL,NvTaskbarInit
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [areslite] "C:\PROGRAM FILES\ARES LITE EDITION\ARESLITE.EXE" -h
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - HKCU\..\Run: [Registry Cleaner] "C:\PROGRAM FILES\REGISTRY CLEANER\REGCLEAN.EXE"
    O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\TOOLS\IESDPB.DLL
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
    O16 - DPF: {8EF27A70-DD04-11D6-B7F6-00A0C9CD5F8A} - http://www.quikshield.com/qshsetup.exe
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10...o.cab32846.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab31267.cab
  4. 13-01-2005  #4
    owen
    owen is offline D-A-L Team Member (UK)
    Save 20% on AVG Internet Security 2012 Suite!
    Nothing wrong now. How are things running?
+ Reply to Thread
« My Hijack This | Several problems: Hijackthis log »