PDA

View Full Version : HijackThis Log for res://D:\WINNT2\system32\shdoclc.dll/navcancl.htm

Tiv
02-04-2005, 09:16 PM
Logfile of HijackThis v1.99.0
Scan saved at 8:54:21 PM, on 2/4/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINNT2\System32\smss.exe
D:\WINNT2\system32\winlogon.exe
D:\WINNT2\system32\services.exe
D:\WINNT2\system32\lsass.exe
D:\WINNT2\system32\svchost.exe
D:\WINNT2\system32\spoolsv.exe
D:\WINNT2\System32\svchost.exe
D:\WINNT2\system32\nvsvc32.exe
D:\WINNT2\system32\regsvc.exe
D:\WINNT2\system32\MSTask.exe
D:\WINNT2\System32\WBEM\WinMgmt.exe
D:\WINNT2\system32\svchost.exe
D:\WINNT2\Explorer.EXE
D:\WINNT2\system32\RUNDLL32.EXE
D:\WINNT2\SOUNDMAN.EXE
D:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe
D:\WINNT2\system32\wuauclt.exe
D:\WINNT2\explorer.exe
D:\Documents and Settings\Tividar.C1793317-A\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SEDP Class - {3BA765C2-08DB-4fe2-9279-311CA10D582A} - D:\WINNT2\sehlp.dll
O2 - BHO: (no name) - {4AAC3757-BD1F-79C7-855D-16550A87704B} - D:\WINNT2\system32\quhw.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT2\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINNT2\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINNT2\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [projselector] "D:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" -r
O4 - HKLM\..\Run: [RoxioEngineUtility] "D:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKCU\..\Run: [Ohcl] D:\Documents and Settings\Tividar.C1793317-A\Application Data\prus.exe
O4 - HKCU\..\Run: [Oeofglc] D:\WINNT2\system32\d?dplay.exe
O4 - HKCU\..\Run: [CTFMON32] D:\WINNT2\system32\CTFMON32.EXE
O4 - HKCU\..\Run: [CSRSSU] D:\WINNT2\system32\CSRSSU.EXE
O13 - WWW. Prefix: http://ehttp.cc/?
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup152.cab
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - D:\WINNT2\System32\dmadmin.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - D:\WINNT2\system32\nvsvc32.exe

I'd appreciate any advice you can dish out; this program is incredibly annoying.

Travis
nightowl
02-04-2005, 09:47 PM
Reboot To Safe Mode (tap F8 on Startup)

Still In Safe Mode Place a check next to each of these and click Fix Checked.


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home
O2 - BHO: SEDP Class - {3BA765C2-08DB-4fe2-9279-311CA10D582A} - D:\WINNT2\sehlp.dll
O2 - BHO: (no name) - {4AAC3757-BD1F-79C7-855D-16550A87704B} - D:\WINNT2\system32\quhw.dll
O4 - HKCU\..\Run: [Oeofglc] D:\WINNT2\system32\d?dplay.exe
O4 - HKCU\..\Run: [CTFMON32] D:\WINNT2\system32\CTFMON32.EXE
O4 - HKCU\..\Run: [CSRSSU] D:\WINNT2\system32\CSRSSU.EXE
O13 - WWW. Prefix: http://ehttp.cc/?
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/downloa...abasetup152.cab

Still In Safe Mode Delete all Temporary Internet Files, Cookies, Do a Defrag on your C Drive, Empty recycle bin.

Start/All Programs/Accessories/System Tools/Disc Defragment

Then Reboot and post a new log..........Jim
Tiv
02-05-2005, 03:48 AM
Logfile of HijackThis v1.99.0
Scan saved at 3:33:43 AM, on 2/5/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINNT2\System32\smss.exe
D:\WINNT2\system32\winlogon.exe
D:\WINNT2\system32\services.exe
D:\WINNT2\system32\lsass.exe
D:\WINNT2\system32\svchost.exe
D:\WINNT2\system32\spoolsv.exe
D:\WINNT2\System32\svchost.exe
D:\WINNT2\system32\nvsvc32.exe
D:\WINNT2\system32\regsvc.exe
D:\WINNT2\system32\MSTask.exe
D:\WINNT2\System32\WBEM\WinMgmt.exe
D:\WINNT2\system32\svchost.exe
D:\WINNT2\Explorer.EXE
D:\WINNT2\system32\RUNDLL32.EXE
D:\WINNT2\SOUNDMAN.EXE
D:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe
D:\WINNT2\system32\wuauclt.exe
D:\WINNT2\explorer.exe
D:\Documents and Settings\Tividar.C1793317-A\Desktop\hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINNT2\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINNT2\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINNT2\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [projselector] "D:\Program Files\Common Files\Roxio Shared\Project Selector\projselector.exe" -r
O4 - HKLM\..\Run: [RoxioEngineUtility] "D:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKCU\..\Run: [Ohcl] D:\Documents and Settings\Tividar.C1793317-A\Application Data\prus.exe
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - D:\WINNT2\System32\dmadmin.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - D:\WINNT2\system32\nvsvc32.exe

Thank you very much for the quick and accurate response. It appears to hafve worked very well.
Travis
nightowl
02-05-2005, 11:12 AM
Glad I was able to help. Download these 3 programs for prevention.


http://forums.designtechnica.com/showthread.php?t=5583


Download Spybot, AdAware, SpywareBlaster (Links Above)


Run and Update Adaware and Spybot at least once a week to keep it clean.
Update SpywareBlaster once a week Enable all Protection and let it run in the background.........Jim :vivi