Holy bejeezus, look at this log...

Daltonator · Post by **Daltonator** » 2004-06-06 06:54pm

This is the HijackThis log from my aunt's computer, about halfway through cleansing. I had already run it but the computer crashed halfway through.

Logfile of HijackThis v1.97.2
Scan saved at 6:51:05 PM, on 6/7/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SVEHOST.EXE
C:\WINDOWS\SYSUPD.EXE
C:\WINDOWS\IVNPSQ.EXE
C:\PROGRAM FILES\WEBHANCER\PROGRAMS\WHAGENT.EXE
C:\PROGRAM FILES\INTERNET OPTIMIZER\OPTIMIZE.EXE
C:\PROGRAM FILES\ISTSVC\ISTSVC.EXE
C:\PROGRAM FILES\180SOLUTIONS\MSBB.EXE
C:\PROGRAM FILES\CLOCKSYNC\SYNC.EXE
C:\PROGRAM FILES\INTERNET OPTIMIZER\ACTALERT.EXE
C:\PROGRAM FILES\AMERICA ONLINE 9.0B\WAOL.EXE
C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE
C:\PROGRAM FILES\BARGAIN BUDDY\BIN\BARGAINS.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\ACS\ACSD.EXE
C:\PROGRAM FILES\AMERICA ONLINE 9.0B\SHELLMON.EXE
C:\PROGRAM FILES\AMERICA ONLINE 9.0B\AOLWBSPD.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\WINDOWS\TEMP\TD_0002.DIR\HIJACKTHIS.EXE

R3 - URLSearchHook: (no name) - _{707E6F76-9FFB-4920-A976-EA101271BC25} - (no file)
R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\PROGRAM FILES\TV MEDIA\TvmBho.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL
O2 - BHO: (no name) - {00000EF1-0786-4633-87C6-1AA7A44296DA} - C:\WINDOWS\SYSTEM\N3TPA1P.DLL
O2 - BHO: (no name) - {00041A26-7033-432C-94C7-6371DE343822} - C:\PROGRAM FILES\SCBAR\V2\SCBAR.DLL (file missing)
O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\SYSTEM\BRIDGE.DLL
O2 - BHO: (no name) - {D8E25C53-9508-4f5c-9249-D98D438891D5} - C:\WINDOWS\SYSTEM\SSURF022.DLL (file missing)
O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - C:\WINDOWS\BI.DLL
O2 - BHO: (no name) - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - C:\PROGRAM FILES\IESEARCHBAR\IESEARCHBAR.DLL
O2 - BHO: IE Agent - {00000000-0000-0000-0000-000000000221} - C:\PROGRA~1\CLEARS~1\CSIE.DLL
O2 - BHO: (no name) - {00000762-3965-4A1A-98CE-3D4BF457D4C8} - C:\PROGRAM FILES\LYCOS\SIDESEARCH\SIDESEARCH1400.DLL
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL (file missing)
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll
O2 - BHO: Url Catcher - {CE31A1F7-3D90-4874-8FBE-A5D97F8BC8F1} - C:\PROGRAM FILES\BARGAIN BUDDY\BIN\APUC.DLL
O2 - BHO: (no name) - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\PROGRAM FILES\WEBHANCER\PROGRAMS\WHIEHLPR.DLL
O2 - BHO: (no name) - {F7F808F0-6F7D-442C-93E3-4A4827C2E4C8} - C:\WINDOWS\NEM218.DLL
O2 - BHO: (no name) - {8F4E5661-F99E-4B3E-8D85-0EA71C0748E4} - C:\WINDOWS\WSEM218.DLL
O2 - BHO: (no name) - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\BXXS5.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: IE Search Bar - {71ED4FBA-4024-4bbe-91DC-9704C93F453E} - C:\PROGRAM FILES\IESEARCHBAR\IESEARCHBAR.DLL
O3 - Toolbar: ISTbar - {5F1ABCDB-A875-46c1-8345-B72A4567E486} - C:\PROGRAM FILES\ISTBAR\ISTBAR.DLL
O4 - HKLM\..\Run: [MSConfigReminder] C:\WINDOWS\SYSTEM\msconfig.exe /reminder
O4 - HKLM\..\Run: [Windows Svehost Services] SVEHOST.EXE
O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\SYSTEM\BRIDGE.DLL",Load
O4 - HKLM\..\Run: [systray] C:\WINDOWS\SYSTEM\A.EXE
O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\BXXS5.DLL,DllRun
O4 - HKLM\..\Run: [TV Media] C:\PROGRAM FILES\TV MEDIA\TVM.EXE
O4 - HKLM\..\Run: [SysUpd] C:\WINDOWS\SYSUPD.EXE
O4 - HKLM\..\Run: [egokllj] C:\WINDOWS\ivnpsq.exe
O4 - HKLM\..\Run: [webHancer Agent] "C:\Program Files\webHancer\Programs\whAgent.exe"
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [Bargains] C:\Program Files\Bargain Buddy\bin\bargains.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [msbb] c:\program files\180solutions\msbb.exe
O4 - HKLM\..\Run: [nwx] C:\WINDOWS\nwx.exe
O4 - HKCU\..\Run: [TV Media] C:\PROGRAM FILES\TV MEDIA\TVM.EXE
O4 - HKCU\..\Run: [ClockSync] C:\Program Files\ClockSync\Sync.exe
O4 - HKCU\..\RunServices: [TV Media] C:\PROGRAM FILES\TV MEDIA\TVM.EXE
O4 - HKCU\..\RunServices: [ClockSync] C:\Program Files\ClockSync\Sync.exe
O4 - HKCU\..\RunOnce: [Windows Svehost Services] SVEHOST.EXE
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: Encarta Encyclopedia (HKLM)
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
O9 - Extra button: Define (HKLM)
O9 - Extra 'Tools' menuitem: Define (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Sidesearch (HKLM)
O9 - Extra button: Real.com (HKLM)
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shoc ... /swdir.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/C ... 7330208333
O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://download.toontown.com/sv1.0.8.11/ttinst.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = aoldsl.net

I think this is the result of having two teenagers as the primary users...

Super-Gagme · Post by **Super-Gagme** » 2004-06-06 07:12pm

What's wrong with Teenagers? For the better part of my Teenagers years I did the computer fixing for all of my family AND friends. Maybe if you said "typical teenagers" I'd agree :p

Pu-239 · Post by **Pu-239** » 2004-06-06 08:04pm

I used to be stupid enough to actually deliberatly install the stuff (~13-14). Of course, I'm more knowledgable now (and obsessive)...

Shinova · Post by **Shinova** » 2004-06-06 08:07pm

How dirty...

Post by **Dalton** » 2004-06-06 08:17pm

Super-Gagme wrote:What's wrong with Teenagers? For the better part of my Teenagers years I did the computer fixing for all of my family AND friends. Maybe if you said "typical teenagers" I'd agree :p

So sorry for offending your delicate sensibilities.

Shinova wrote:How dirty...

Very, very dirty. Oddly enough, the best way to clean it is via a method I like to call the Einhander Special.

phongn · Post by **phongn** » 2004-06-06 10:25pm

Holy shit.

I wish more computer programmers would properly write Windows programs so that you could run it under User level (rather than Administrator) -- that alone would stop much of this junk from occurring (since only Administrator or Power User can install).

darthdavid · Post by **darthdavid** » 2004-06-06 11:01pm

My little sister is like that. She actually clicks on popups.

Temjin · Post by **Temjin** » 2004-06-06 11:33pm

darthdavid wrote:My little sister is like that. She actually clicks on popups.

There are actually people like that? I thought it was just a myth to scare little kids....

Uraniun235 · Post by **Uraniun235** » 2004-06-06 11:50pm

phongn wrote:I wish more computer programmers would properly write Windows programs...

Popped in a Computer Gaming World disc recently (I bought an issue since they had a preview of Battlefield 2) and the menu program took forever to load... checked Task Manager and the fucking thing was gobbling up over 100MB of RAM.

phongn · Post by **phongn** » 2004-06-06 11:53pm

Ugh.

To clarify above, for some reason a lot of programs insist in storing data in the HKLM section of the registry for user-data when they should be using HKCU. Furthermore, they should also be using My Documents and not their own directory for file storage. There are probably a few other things that would improve security...

Crayz9000 · Post by **Crayz9000** » 2004-06-07 02:42am

phongn wrote:To clarify above, for some reason a lot of programs insist in storing data in the HKLM section of the registry for user-data when they should be using HKCU. Furthermore, they should also be using My Documents and not their own directory for file storage. There are probably a few other things that would improve security...

Like Windows forcing programs to do the above things.

Pu-239 · Post by **Pu-239** » 2004-06-07 03:31am

Is there something like the SUID bit for Windows (not that it would help, people would be too lazy to set it and would run as admin all the time anyway)?

Comosicus · Post by **Comosicus** » 2004-06-07 03:35am

Dalton wrote: Very, very dirty. Oddly enough, the best way to clean it is via a method I like to call the Einhander Special.

format c: [ENTER] y [ENTER]?

Pu-239 · Post by **Pu-239** » 2004-06-07 04:24am

Even better: format C: /autotest DO NOT ENTER THIS- it does not prompt at all before proceeding to format hard drive, at least on 9x

Which means it's a nasty command to chuck into a boot floppy's autoexec.bat, considering many people have boot from floppy enabled... have autoexec.bat as a hidden file, put data on floppy, and user will probably leave floppy in at one point upon bootup...

Faram · Post by **Faram** » 2004-06-07 04:32am

Blah wusses!

"recover c:" in dos 2 - 5 was a kickass tool!

That one messed up the HD bigtime

Post by **The Wookiee** » 2004-06-07 09:14am

Comosicus wrote:
Dalton wrote: Very, very dirty. Oddly enough, the best way to clean it is via a method I like to call the Einhander Special.
format c: [ENTER] y [ENTER]?

Hah, I wish

I just cleaned house with HijackThis, Spybot S&D and AVG Antivirus.

phongn · Post by **phongn** » 2004-06-07 10:25am

Pu-239 wrote:Is there something like the SUID bit for Windows (not that it would help, people would be too lazy to set it and would run as admin all the time anyway)?

No.

jenat-lai · Post by **jenat-lai** » 2004-06-10 10:54pm

howbout when your primary bootup disk isn't C: bwahaha