1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Hijacked, please help!

Discussion in 'Virus & Other Malware Removal' started by jmaze, Sep 4, 2004.

Thread Status:
Not open for further replies.
Page 1 of 3
Advertisement
  1. jmaze

    jmaze Thread Starter

    Joined:
    Jun 24, 2004
    Messages:
    24
    Following is the Hijack this Log, if you can help me clean it, I would greatly appreciate it. Thank you.

    Logfile of HijackThis v1.98.2
    Scan saved at 12:36:24 AM, on 9/4/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Creative\ShareDLL\CtNotify.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\PROGRA~1\Web Offer\wo.exe
    C:\WINDOWS\System32\devldr32.exe
    C:\Program Files\Creative\ShareDLL\MediaDet.Exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Avant Browser\avant.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Documents and Settings\Josh\Desktop\New Folder\HijackThis.exe
    C:\WINDOWS\System32\usp10.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
    O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
    O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\localNRD.dll
    O2 - BHO: Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B} - C:\Program Files\Recommended Hotfix - 421701D\v15\RH.DLL
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)
    O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\System32\nvms.dll
    O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\System32\mscb.dll
    O2 - BHO: (no name) - {D848A3CA-0BFB-4DE0-BA9E-A57F0CCA1C13} - (no file)
    O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
    O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
    O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [snlnsuuwexsa] C:\WINDOWS\System32\fnkqisnl.exe
    O4 - HKLM\..\Run: [msbb] c:\program files\180solutions\msbb.exe
    O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [WebRebates0] C:\Program Files\Web_Rebates\WebRebates0.exe
    O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
    O4 - HKCU\..\Run: [in10b6s] C:\WINDOWS\System32\in10b6s.exe
    O4 - HKCU\..\Run: [usp10] C:\WINDOWS\System32\usp10.exe
    O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm
    O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm
    O8 - Extra context menu item: Open All Links in This Page... - C:\Program Files\Avant Browser\OpenAllLinks.htm
    O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/12119/CTSUEng.cab
    O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1094102280061
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15008/CTPID.cab
     
    jmaze, Sep 4, 2004
    #1
  3. Nok1

    Nok1

    Joined:
    Feb 15, 2004
    Messages:
    826
    Remove these entries by checking them and clicking fix (make sure that all other windows besides hijackthis are closed):

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = res://C:\PROGRA~1\Toolbar\toolbar.dll/sa
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
    O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
    O2 - BHO: LocalNRDObj Class - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - C:\WINDOWS\localNRD.dll
    O2 - BHO: Recommended Hotfix - {0421701D-CF13-4E70-ADF0-45A953E7CB8B} - C:\Program Files\Recommended Hotfix - 421701D\v15\RH.DLL
    O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)
    O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\System32\nvms.dll
    O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\System32\mscb.dll
    O2 - BHO: (no name) - {D848A3CA-0BFB-4DE0-BA9E-A57F0CCA1C13} - (no file)
    O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll
    O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
    O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
    O4 - HKLM\..\Run: [snlnsuuwexsa] C:\WINDOWS\System32\fnkqisnl.exe
    O4 - HKLM\..\Run: [msbb] c:\program files\180solutions\msbb.exe
    O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
    O4 - HKLM\..\Run: [WebRebates0] C:\Program Files\Web_Rebates\WebRebates0.exe
    O4 - HKCU\..\Run: [eZWO] C:\PROGRA~1\Web Offer\wo.exe
    O4 - HKCU\..\Run: [in10b6s] C:\WINDOWS\System32\in10b6s.exe
    O4 - HKCU\..\Run: [usp10] C:\WINDOWS\System32\usp10.exe
    O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab

    Next, Go to add/remove programs, and see if you can uninstal (or find) something called
    180solutions
    VirtualBouncer
    WebRebates/Offers


    Next, reboot to safe mode and enable viewing of hidden/system files (instuctions below) and delete these files:

    C:\WINDOWS\System32\fnkqisnl.exe
    C:\WINDOWS\System32\in10b6s.exe
    C:\WINDOWS\System32\usp10.exe

    Next, delete the following folders if present:
    C:\PROGRAM FILES\Toolbar
    c:\program files\180solutions
    C:\Program Files\Web_Rebates
    C:\PROGRAM FILES\VBouncer
    C:\PROGRAM FILES\Web Offer

    How to boot to safe mode - http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406
    How to enable viewing of hidden/system files - http://www.xtra.co.nz/help/0,,4155-1916458,00.html

    After all that good stuff, reboot and post a new Hijackthis log.
     
    Nok1, Sep 4, 2004
    #2
  4. jmaze

    jmaze Thread Starter

    Joined:
    Jun 24, 2004
    Messages:
    24
    Thanks, I'll do that and post a new log.
     
    jmaze, Sep 4, 2004
    #3
  5. jmaze

    jmaze Thread Starter

    Joined:
    Jun 24, 2004
    Messages:
    24
    Logfile of HijackThis v1.98.2
    Scan saved at 1:34:45 AM, on 9/4/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Creative\ShareDLL\CtNotify.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\System32\devldr32.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Creative\ShareDLL\MediaDet.Exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Documents and Settings\Josh\Desktop\New Folder\HijackThis.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [usp10] C:\WINDOWS\System32\usp10.exe
    O8 - Extra context menu item: Add to AD Black List - C:\Program Files\Avant Browser\AddToADBlackList.htm
    O8 - Extra context menu item: Block All Images from the Same Server - C:\Program Files\Avant Browser\AddAllToADBlackList.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Highlight - C:\Program Files\Avant Browser\Highlight.htm
    O8 - Extra context menu item: Open All Links in This Page... - C:\Program Files\Avant Browser\OpenAllLinks.htm
    O8 - Extra context menu item: Search - C:\Program Files\Avant Browser\Search.htm
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/12119/CTSUEng.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1094102280061
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15008/CTPID.cab
     
    jmaze, Sep 4, 2004
    #4
  6. jmaze

    jmaze Thread Starter

    Joined:
    Jun 24, 2004
    Messages:
    24
    You wanna know the ironic part? I got hijacked because I mistyped a URL. I was trying to download Sygate Personal firewall, because I just wiped my system and am running from a fresh install of Windows XP. The first thing I went to do was protect my system, and I get hijacked before I can do it. Oh well. I'm beginning to hate technology...
     
    jmaze, Sep 4, 2004
    #5
  7. jmaze

    jmaze Thread Starter

    Joined:
    Jun 24, 2004
    Messages:
    24
    I still see that usp10 running. I know that I deleted it in Safe Mode. Damn it!!!
     
    jmaze, Sep 4, 2004
    #6
  8. Nok1

    Nok1

    Joined:
    Feb 15, 2004
    Messages:
    826
    Hehe. Bummer. Okay upload the following file to the site below and paste back the results.

    C:\WINDOWS\System32\usp10.exe

    http://virusscan.jotti.dhs.org/
     
    Nok1, Sep 4, 2004
    #7
  9. Nok1

    Nok1

    Joined:
    Feb 15, 2004
    Messages:
    826
    Yeah, it should be gone :). Don't worry, it's only a matter of time until we get rid of it.
     
    Nok1, Sep 4, 2004
    #8
  10. jmaze

    jmaze Thread Starter

    Joined:
    Jun 24, 2004
    Messages:
    24
    Hmmm....now USP10.exe is not showing up in system32
    I'm gonna run Hijack this again to see if it shows up.
     
    jmaze, Sep 4, 2004
    #9
  11. jmaze

    jmaze Thread Starter

    Joined:
    Jun 24, 2004
    Messages:
    24
    yeah, still there
     
    jmaze, Sep 4, 2004
    #10
  12. Nok1

    Nok1

    Joined:
    Feb 15, 2004
    Messages:
    826
    Is hidden/system file viewing enabled?

    Also, try removing the entry from hijackthis, reboot and see if it comes back.
     
    Nok1, Sep 4, 2004
    #11
  13. jmaze

    jmaze Thread Starter

    Joined:
    Jun 24, 2004
    Messages:
    24
    I have no idea what to do now....I really don't want to wipe the system and reinstall windows again, I just did that two days ago.
     
    jmaze, Sep 4, 2004
    #12
  14. jmaze

    jmaze Thread Starter

    Joined:
    Jun 24, 2004
    Messages:
    24
    I did have Norton Anti-Virus that I got through the school. I'm gonna look for the disk to install and run it.
     
    jmaze, Sep 4, 2004
    #13
  15. Nok1

    Nok1

    Joined:
    Feb 15, 2004
    Messages:
    826
    Nok1, Sep 4, 2004
    #14
  16. jmaze

    jmaze Thread Starter

    Joined:
    Jun 24, 2004
    Messages:
    24
    the notepad file is empty
     
    jmaze, Sep 4, 2004
    #15

  17. Sponsor

Page 1 of 3
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Similar Threads - Hijacked please help
  1. genubi

    New Hijacked

    genubi, Nov 24, 2019, in forum: Virus & Other Malware Removal
    Replies:
    0
    Views:
    278
    genubi
    Nov 24, 2019
  2. ptheo

    In Progress BocaMonitor how can i delete this Please and thank you

    ptheo, Jun 26, 2019, in forum: Virus & Other Malware Removal
    Replies:
    1
    Views:
    439
    iMacg3
    Jun 26, 2019
  3. ebaile7494

    New Help Please

    ebaile7494, Jun 4, 2019, in forum: Virus & Other Malware Removal
    Replies:
    0
    Views:
    777
    ebaile7494
    Jun 4, 2019
  4. josephw3090

    New Hacked - computer, phone. please advise on protection.

    josephw3090, Mar 19, 2019, in forum: Virus & Other Malware Removal
    Replies:
    0
    Views:
    912
    josephw3090
    Mar 19, 2019
  5. zennymars

    In Progress Virus hacked completely froze my laptop, please help

    zennymars, Feb 12, 2019, in forum: Virus & Other Malware Removal
    Replies:
    1
    Views:
    1,120
    iMacg3
    Feb 14, 2019
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/269972

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice