1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

weird spam from MSN... hijackthis

Discussion in 'Virus & Other Malware Removal' started by idontknowjak, Oct 2, 2003.

Thread Status:
Not open for further replies.
  1. idontknowjak

    idontknowjak Thread Starter

    Joined:
    Jul 7, 2003
    Messages:
    148
    Heres my hijackthis log. Items marked in bold need attention.


    Logfile of HijackThis v1.96.2
    Scan saved at 10:47:10 PM, on 10/2/2003
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\mdm.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\MSN\MSNCoreFiles\MSN6.EXE
    C:\Program Files\Kazaa Lite2\KazaaLite.kpp
    C:\WINDOWS\system32\rundll32.exe
    C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
    O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
    O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe"
    O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
    O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
    O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
    O9 - Extra button: AIM (HKLM)
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O17 - HKLM\System\CCS\Services\Tcpip\..\{F8C45699-7812-41D2-A539-4FA9BB52ADF2}: NameServer = 198.6.1.218 198.6.100.218



    Thanks...
     
  2. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    The AIM button is no doubt for Aol Instant Messenger

    The Name servers associate to your ISP, no problem

    The IE plugin is for Adobe, I believe.
     
  3. winchester73

    winchester73

    Joined:
    Aug 18, 2003
    Messages:
    2,438
    The spam from MSN may be due to Messenger Service, a once useful Microsoft feature that has been targeted by spam merchants ...

    So as not to confuse anybody reading your thread ... Messenger Service and Windows/MSN Messenger are two different things.

    Windows/MSN Messenger is a two-way Instant Messaging chat service that is very popular with millions of people around the world.

    Messenger Service is a one-way announcement-only tool that is very popular with power hungry network administrators (and no one else). It was intended to deliver vital announcements like "The email server is going down in five minutes."

    If your machine is not part of a corporate network, then you can disable the Messenger Service:

    1. Control Panel, Computer Management..
    2. Expand the "Services and Applications" option.
    3. Choose services.
    4. Scroll down the list to find "Messenger"
    5. Right click on the service and choose Stop.
    6. Once it has stopped, right click again, and choose properties.
    7. Change the startup type to "Disabled".

    Disabling will not cause you a problem unless you are on a network (usually in a corporate environment). If that is the case, it is recommended that you check with your network administrator.

    Since you are running XP, I assume you have the built-in firewall activated? Most firewalls will block the spam, but it doesn't do any harm to make this change as well. IMO, the built in XP firewall is pretty much useless ... it is just good enough to give you a false sense of security.

    IMO, a firewall is an absolute must for anyone with a DSL or cable connection ... "always on" means "always exposed".
     
As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/169173

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice