weird spam from MSN... hijackthis

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

idontknowjak

Thread Starter
Joined
Jul 7, 2003
Messages
148
Heres my hijackthis log. Items marked in bold need attention.


Logfile of HijackThis v1.96.2
Scan saved at 10:47:10 PM, on 10/2/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\mdm.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\MSN\MSNCoreFiles\MSN6.EXE
C:\Program Files\Kazaa Lite2\KazaaLite.kpp
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LogonStudio] "C:\Program Files\WinCustomize\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe"
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{F8C45699-7812-41D2-A539-4FA9BB52ADF2}: NameServer = 198.6.1.218 198.6.100.218



Thanks...
 
Joined
Dec 9, 2000
Messages
45,855
The AIM button is no doubt for Aol Instant Messenger

The Name servers associate to your ISP, no problem

The IE plugin is for Adobe, I believe.
 
Joined
Aug 18, 2003
Messages
2,438
The spam from MSN may be due to Messenger Service, a once useful Microsoft feature that has been targeted by spam merchants ...

So as not to confuse anybody reading your thread ... Messenger Service and Windows/MSN Messenger are two different things.

Windows/MSN Messenger is a two-way Instant Messaging chat service that is very popular with millions of people around the world.

Messenger Service is a one-way announcement-only tool that is very popular with power hungry network administrators (and no one else). It was intended to deliver vital announcements like "The email server is going down in five minutes."

If your machine is not part of a corporate network, then you can disable the Messenger Service:

1. Control Panel, Computer Management..
2. Expand the "Services and Applications" option.
3. Choose services.
4. Scroll down the list to find "Messenger"
5. Right click on the service and choose Stop.
6. Once it has stopped, right click again, and choose properties.
7. Change the startup type to "Disabled".

Disabling will not cause you a problem unless you are on a network (usually in a corporate environment). If that is the case, it is recommended that you check with your network administrator.

Since you are running XP, I assume you have the built-in firewall activated? Most firewalls will block the spam, but it doesn't do any harm to make this change as well. IMO, the built in XP firewall is pretty much useless ... it is just good enough to give you a false sense of security.

IMO, a firewall is an absolute must for anyone with a DSL or cable connection ... "always on" means "always exposed".
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Members online

Top