Sunday, August 2, 2009

Please help me to analyse the files hijackthis detact as below?

RegCureLogfile of HijackThis v1.99.1


Scan saved at 16:50:32, on 2007-3-4


Platform: Windows 2000 SP4 (WinNT 5.00.2195)


MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)





Running processes:


C:\WINNT\System32\smss.exe


C:\WINNT\system32\winlogon.exe


C:\WINNT\system32\services.exe


C:\WINNT\system32\lsass.exe


C:\WINNT\system32\svchost.exe


C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe


C:\WINNT\system32\spoolsv.exe


C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr....


C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc....


C:\WINNT\system32\svchost.exe


C:\Program Files\Ahead\InCD\InCDsrv.exe


C:\Program Files\Norton AntiVirus\navapsvc.exe


C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE


C:\WINNT\system32\regsvc.exe


C:\WINNT\system32\MSTask.exe


C:\WINNT\system32\stisvc.exe


C:\WINNT\System32\WBEM\WinMgmt.exe


C:\WINNT\system32\svchost.exe


C:\WINNT\Explorer.EXE


C:\WINNT\system32\internat.exe


c:\progra~1\intern~1\iexplore.exe


C:\Program Files\Internet Explorer\iexplore.exe


C:\Program Files\Rogers\SelfHealing\rogersagent.exe


C:\Program Files\Common Files\Real\Update_OB\realsched.exe


C:\Program Files\Mozilla Firefox\firefox.exe


C:\WINNT\system32\mshta.exe


C:\iE6\HijackThis.exe





R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defa...


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defa...


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defa...


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defa...


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defa...


R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/


R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defa...


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Program Files\Common Files\Microsoft Shared\Stationery\Blank.htm


R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn8\yt....


O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn8\yt....


O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll


O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search %26amp; Destroy\SDHelper.dll


O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll


O3 - Toolbar: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM\tbShar.dll


O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn8\yt....


O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot


O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon


O4 - HKCU\..\Run: [internat.exe] internat.exe


O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background


O4 - HKCU\..\Run: [VoipDiscount] "C:\Program Files\VoipDiscount.com\VoipDiscount\Voip... -nosplash -minimized


O4 - HKCU\..\Run: [FreeCall] "C:\program files\freecall.com\freecall\freecall.exe... -nosplash -minimized


O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.ex... -quiet


O4 - HKCU\..\Run: [SHS] "C:\Program Files\Rogers\SelfHealing\SHS.exe" /background


O4 - HKCU\..\Run: [RogersAgent] c:\Program Files\Rogers\SelfHealing\rogersagent.exe


O4 - HKCU\..\Run: [Windows Registry Repair Pro] C:\Program Files\3B Software\Windows Registry Repair Pro\RegistryRepairPro.exe 4


O4 - HKCU\..\Run: [Bleh Idle] C:\DOCUME~1\ADMINI~1\APPLIC~1\INTRAG~1\e...


O4 - HKCU\..\RunOnce: [ypagerps6] cmd.exe /C del "C:\Program Files\Yahoo!\Messenger\ypagerps6.DLL"


O8 - Extra context menu item: %26amp;Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm


O8 - Extra context menu item: Yahoo! %26amp;Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm


O8 - Extra context menu item: Yahoo! %26amp;Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm


O8 - Extra context menu item: Yahoo! %26amp;SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm


O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll


O10 - Unknown file in Winsock LSP: c:\winnt\system32\toonjoke.dll


O10 - Unknown file in Winsock LSP: c:\winnt\system32\toonjoke.dll


O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll


O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.ex...


O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.ex...


O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe


O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe


O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe


O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe


O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe


O23 - Service: InCD Helper (read only) (InCDsrvR) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe


O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe


O23 - Service: Network Tran mngr (Network Tran) - Unknown owner - c:\winnt\system32\flashtem.exe


O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE


O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\S...


O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe


O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe


O23 - Service: TPK host (TPK) - Unknown owner - C:\WINNT\system32\TaskPK.exe (file missing)

Please help me to analyse the files hijackthis detact as below?
This is not an appropriate site to post Hijack This logs. You have no knowledge of the person who will advise you.





You need to go to one of the many sites that accept HJT logs and have professionals instruct you in what to delete. Tom Coyote, Bleeping Computer, Major Geeks, and many others have forum for this purpose.
Reply:Copy your results and paste them here


http://www.hijackthis.de/





then click analyze.


No comments:

Post a Comment