StarDestroyer.Net BBS

Get your fill of sci-fi, science, and mockery of stupid ideas
http://stardestroyer.dyndns-home.com/

Holy bejeezus, look at this log...

http://stardestroyer.dyndns-home.com/viewtopic.php?f=24&t=46791

Page 1 of 1

Holy bejeezus, look at this log...

Posted: 2004-06-06 06:54pm
by Daltonator
This is the HijackThis log from my aunt's computer, about halfway through cleansing. I had already run it but the computer crashed halfway through.
Logfile of HijackThis v1.97.2
Scan saved at 6:51:05 PM, on 6/7/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SVEHOST.EXE
C:\WINDOWS\SYSUPD.EXE
C:\WINDOWS\IVNPSQ.EXE
C:\PROGRAM FILES\WEBHANCER\PROGRAMS\WHAGENT.EXE
C:\PROGRAM FILES\INTERNET OPTIMIZER\OPTIMIZE.EXE
C:\PROGRAM FILES\ISTSVC\ISTSVC.EXE
C:\PROGRAM FILES\180SOLUTIONS\MSBB.EXE
C:\PROGRAM FILES\CLOCKSYNC\SYNC.EXE
C:\PROGRAM FILES\INTERNET OPTIMIZER\ACTALERT.EXE
C:\PROGRAM FILES\AMERICA ONLINE 9.0B\WAOL.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE
C:\PROGRAM FILES\BARGAIN BUDDY\BIN\BARGAINS.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\ACS\ACSD.EXE
C:\PROGRAM FILES\AMERICA ONLINE 9.0B\SHELLMON.EXE
C:\PROGRAM FILES\AMERICA ONLINE 9.0B\AOLWBSPD.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\WINDOWS\TEMP\TD_0002.DIR\HIJACKTHIS.EXE

R3 - URLSearchHook: (no name) - _{707E6F76-9FFB-4920-A976-EA101271BC25} - (no file)
R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\PROGRAM FILES\TV MEDIA\TvmBho.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL
O2 - BHO: (no name) - {00000EF1-0786-4633-87C6-1AA7A44296DA} - C:\WINDOWS\SYSTEM\N3TPA1P.DLL
O2 - BHO: (no name) - {00041A26-7033-432C-94C7-6371DE343822} - C:\PROGRAM FILES\SCBAR\V2\SCBAR.DLL (file missing)
O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\SYSTEM\BRIDGE.DLL
O2 - BHO: (no name) - {D8E25C53-9508-4f5c-9249-D98D438891D5} - C:\WINDOWS\SYSTEM\SSURF022.DLL (file missing)
O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - C:\WINDOWS\BI.DLL
O2 - BHO: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - C:\PROGRAM FILES\IESEARCHBAR\IESEARCHBAR.DLL
O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000000221} - C:\PROGRA~1\CLEARS~1\CSIE.DLL
O2 - BHO: (no name) - {00000762-3965-4A1A-98CE-3D4BF457D4C8} - C:\PROGRAM FILES\LYCOS\SIDESEARCH\SIDESEARCH1400.DLL
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll
O2 - BHO: Url Catcher - {CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1} - C:\PROGRAM FILES\BARGAIN BUDDY\BIN\APUC.DLL
O2 - BHO: (no name) - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\PROGRAM FILES\WEBHANCER\PROGRAMS\WHIEHLPR.DLL
O2 - BHO: (no name) - {F7F808F0-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\NEM218.DLL
O2 - BHO: (no name) - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\WSEM218.DLL
O2 - BHO: (no name) - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\BXXS5.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: IE Search Bar - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - C:\PROGRAM FILES\IESEARCHBAR\IESEARCHBAR.DLL
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\PROGRAM FILES\ISTBAR\ISTBAR.DLL
O4 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\msconfig.exe /reminder
O4 - HKLM\..\Run: [Windows Svehost Services] SVEHOST.EXE
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\SYSTEM\BRIDGE.DLL",Load
O4 - HKLM\..\Run: [systray] C:\WINDOWS\SYSTEM\A.EXE
O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\BXXS5.DLL,DllRun
O4 - HKLM\..\Run: [TV Media] C:\PROGRAM FILES\TV MEDIA\TVM.EXE
O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS\SYSUPD.EXE
O4 - HKLM\..\Run: [egokllj] C:\WINDOWS\ivnpsq.exe
O4 - HKLM\..\Run: [webHancer Agent] "C:\Program Files\webHancer\Programs\whAgent.exe"
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [Bargains] C:\Program Files\Bargain Buddy\bin\bargains.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [msbb] c:\program files\180solutions\msbb.exe
O4 - HKLM\..\Run: [nwx] C:\WINDOWS\nwx.exe
O4 - HKCU\..\Run: [TV Media] C:\PROGRAM FILES\TV MEDIA\TVM.EXE
O4 - HKCU\..\Run: [ClockSync] C:\Program Files\ClockSync\Sync.exe
O4 - HKCU\..\RunServices: [TV Media] C:\PROGRAM FILES\TV MEDIA\TVM.EXE
O4 - HKCU\..\RunServices: [ClockSync] C:\Program Files\ClockSync\Sync.exe
O4 - HKCU\..\RunOnce: [Windows Svehost Services] SVEHOST.EXE
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: Encarta Encyclopedia (HKLM)
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
O9 - Extra button: Define (HKLM)
O9 - Extra 'Tools' menuitem: Define (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Sidesearch (HKLM)
O9 - Extra button: Real.com (HKLM)
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shoc ... /swdir.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/C ... 7330208333
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.8.11/ttinst.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = aoldsl.net
I think this is the result of having two teenagers as the primary users...

Posted: 2004-06-06 07:12pm
by Super-Gagme
What's wrong with Teenagers? For the better part of my Teenagers years I did the computer fixing for all of my family AND friends. Maybe if you said "typical teenagers" I'd agree :p

Posted: 2004-06-06 08:04pm
by Pu-239
I used to be stupid enough to actually deliberatly install the stuff (~13-14). Of course, I'm more knowledgable now (and obsessive)...

Posted: 2004-06-06 08:07pm
by Shinova
How dirty...

Posted: 2004-06-06 08:17pm
by Dalton
Super-Gagme wrote:What's wrong with Teenagers? For the better part of my Teenagers years I did the computer fixing for all of my family AND friends. Maybe if you said "typical teenagers" I'd agree :p
So sorry for offending your delicate sensibilities.
Shinova wrote:How dirty...
Very, very dirty. Oddly enough, the best way to clean it is via a method I like to call the Einhander Special.

Posted: 2004-06-06 10:25pm
by phongn
Holy shit.

I wish more computer programmers would properly write Windows programs so that you could run it under User level (rather than Administrator) -- that alone would stop much of this junk from occurring (since only Administrator or Power User can install).

Posted: 2004-06-06 11:01pm
by darthdavid
My little sister is like that. She actually clicks on popups.

Posted: 2004-06-06 11:33pm
by Temjin
darthdavid wrote:My little sister is like that. She actually clicks on popups.
There are actually people like that? I thought it was just a myth to scare little kids....

Posted: 2004-06-06 11:50pm
by Uraniun235
phongn wrote:I wish more computer programmers would properly write Windows programs...
Popped in a Computer Gaming World disc recently (I bought an issue since they had a preview of Battlefield 2) and the menu program took forever to load... checked Task Manager and the fucking thing was gobbling up over 100MB of RAM.

Posted: 2004-06-06 11:53pm
by phongn
Ugh.

To clarify above, for some reason a lot of programs insist in storing data in the HKLM section of the registry for user-data when they should be using HKCU. Furthermore, they should also be using My Documents and not their own directory for file storage. There are probably a few other things that would improve security...

Posted: 2004-06-07 02:42am
by Crayz9000
phongn wrote:To clarify above, for some reason a lot of programs insist in storing data in the HKLM section of the registry for user-data when they should be using HKCU. Furthermore, they should also be using My Documents and not their own directory for file storage. There are probably a few other things that would improve security...
Like Windows forcing programs to do the above things.

Posted: 2004-06-07 03:31am
by Pu-239
Is there something like the SUID bit for Windows (not that it would help, people would be too lazy to set it and would run as admin all the time anyway)?

Posted: 2004-06-07 03:35am
by Comosicus
Dalton wrote: Very, very dirty. Oddly enough, the best way to clean it is via a method I like to call the Einhander Special.
format c: [ENTER] y [ENTER]? :mrgreen:

Posted: 2004-06-07 04:24am
by Pu-239
Even better: format C: /autotest DO NOT ENTER THIS- it does not prompt at all before proceeding to format hard drive, at least on 9x

Which means it's a nasty command to chuck into a boot floppy's autoexec.bat, considering many people have boot from floppy enabled... have autoexec.bat as a hidden file, put data on floppy, and user will probably leave floppy in at one point upon bootup...

Posted: 2004-06-07 04:32am
by Faram
Blah wusses!

"recover c:" in dos 2 - 5 was a kickass tool!

That one messed up the HD bigtime

Posted: 2004-06-07 09:14am
by The Wookiee
Comosicus wrote:
Dalton wrote: Very, very dirty. Oddly enough, the best way to clean it is via a method I like to call the Einhander Special.
format c: [ENTER] y [ENTER]? :mrgreen:
Hah, I wish :D

I just cleaned house with HijackThis, Spybot S&D and AVG Antivirus.

Posted: 2004-06-07 10:25am
by phongn
Pu-239 wrote:Is there something like the SUID bit for Windows (not that it would help, people would be too lazy to set it and would run as admin all the time anyway)?
No.

Posted: 2004-06-10 10:54pm
by jenat-lai
howbout when your primary bootup disk isn't C: bwahaha
All times are UTC-05:00
Page 1 of 1

Powered by phpBB® Forum Software © phpBB Limited