Tech Support Guy banner
  • IMPORTANT: Only authorized members may reply to threads in this forum due to the complexity of the malware removal process. Authorized members include Malware Specialists and Trainees, Administrators, Moderators, and Trusted Advisors. Regular members are not permitted to reply, and any such posts will be deleted without notice or further explanation. Notice
Status
Not open for further replies.
1 - 3 of 3 Posts

·
Registered
Joined
·
3 Posts
Discussion Starter · #1 ·
Hello to everyone!

Dear friends I will like to ask for your help in this moment, because my system is not responding correctly. I have generate the respective .log file with Hijackthis. What happens principally is that it seems that my computer is updating something, also some .ini and .dat files are updating without any real reason... I know my system and I am sure there is something strange there, but lamentably I can not determine and fix it. Computer behavior and internet are getting slower.

Computer characteristics:
OS: Windows 98SE
IE 6.0
Dell Optiplex GX1 Pentium III 512 RAM
Commonly using Lavasoft AdAware, Spywareblaster and CWShredder for virus scan.

*** This is the Hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:03:12, on 10/03/08
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\ARCHIVOS DE PROGRAMA\ANI\ANIWZCS2 SERVICE\WZCSLDR2.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\TASKMON.EXE
C:\ARCHIVOS DE PROGRAMA\THE HACKER\THAV.EXE
C:\ARCHIVOS DE PROGRAMA\CYBERLINK DVD SOLUTION\POWERDVD\PDVDSERV.EXE
C:\ARCHIVOS DE PROGRAMA\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\JCCATCH.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\ARCHIVOS DE PROGRAMA\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FGIEBAR.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [TheHackerConsola] C:\ARCHIV~1\THEHAC~1\THAV.EXE /NOPRE
O4 - HKLM\..\Run: [RemoteControl] "C:\Archivos de programa\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Archivos de programa\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\RunServices: [ATIPOLL] ati2evxx.exe
O4 - HKLM\..\RunServices: [ATISmart] C:\WINDOWS\SYSTEM\ati2s9ag.exe
O4 - HKLM\..\RunServices: [ANIWZCS2Service] C:\Archivos de programa\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKUS\.DEFAULT\..\Run: [PowerBar] (User 'Default user')
O4 - .DEFAULT Startup: Microsoft Office.lnk = C:\Archivos de programa\Microsoft Office\Office\OSA9.EXE (User 'Default user')
O4 - .DEFAULT Startup: Control de sonido 3D Crystal.lnk = C:\WINDOWS\CWD3DSND.EXE (User 'Default user')
O4 - Startup: Microsoft Office.lnk = C:\Archivos de programa\Microsoft Office\Office\OSA9.EXE
O4 - Startup: Control de sonido 3D Crystal.lnk = C:\WINDOWS\CWD3DSND.EXE
O8 - Extra context menu item: Download using Offline &Explorer - file://C:\ARCHIVOS DE PROGRAMA\OFFLINE EXPLORER PRO\Add_Url.htm
O8 - Extra context menu item: Download the &current page with Offline Explorer - file://C:\ARCHIVOS DE PROGRAMA\OFFLINE EXPLORER PRO\Add_All.htm
O8 - Extra context menu item: Descargar con Fl&ashGet - C:\ARCHIVOS DE PROGRAMA\FLASHGET\jc_link.htm
O8 - Extra context menu item: Descargar todo con Flas&hGet - C:\ARCHIVOS DE PROGRAMA\FLASHGET\jc_all.htm
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FLASHGET.EXE
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\ARCHIVOS DE PROGRAMA\FLASHGET\FLASHGET.EXE
O12 - Plugin for .spop: C:\ARCHIV~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - http://www.pandasoftware.es/activescan/as/asinst.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O24 - Desktop Component 0: (no name) - file:///C:/Mis documentos/Mis imágenes/Resize of Neo.gif

--
End of file - 4392 bytes

I will be waiting for your answers and details about the steps to follow in order to clean this.

Thanks a lot for your help and support in advance!
.JF.
 
1 - 3 of 3 Posts
Status
Not open for further replies.
Top