Hello and welcome to our community! Is this your first visit?
Register
Enjoy an ad free experience by logging in. Not a member yet? Register.
Results 1 to 9 of 9
  1. #1
    Senior Coder crmpicco's Avatar
    Join Date
    Jan 2005
    Location
    Mauchline, Scotland
    Posts
    1,097
    Thanks
    15
    Thanked 1 Time in 1 Post

    HijackThis Log File - can someone take a wee look? :-)

    Mery Christmas to all on the forum!

    Below I have copied my HijackThis log file after I ran it just a second ago.

    It mentioned to check with experts before i deleted anything.

    You may notice alot of winmx entries in my hosts file, but I have put them there and this is not something someone else has done.

    Any help is appreciated.

    Picco

    ___________________________________________________________

    Logfile of HijackThis v1.99.1
    Scan saved at 17:24:02, on 26/12/2005
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\v21\Dialler\V21.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\v21\Dialler\StatWnd.dll
    C:\Documents and Settings\Gillian Young\My Documents\apps\hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aol.co.uk/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://portal.v21.co.uk
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by V21
    F2 - REG:system.ini: UserInit="main3.exe" - -
    O1 - Hosts: 205.238.40.2 www.winmx.com
    O1 - Hosts: 205.238.40.2 err.winmx.com
    O1 - Hosts: 205.238.40.2 c3310.z1301.winmx.com
    O1 - Hosts: 67.18.233.36 c3311.z1301.winmx.com
    O1 - Hosts: 82.43.224.20 c3312.z1301.winmx.com
    O1 - Hosts: 209.67.209.50 c3313.z1301.winmx.com
    O1 - Hosts: 212.227.64.159 c3314.z1301.winmx.com
    O1 - Hosts: 205.238.40.2 c3315.z1301.winmx.com
    O1 - Hosts: 67.18.233.36 c3316.z1301.winmx.com
    O1 - Hosts: 82.43.224.20 c3317.z1301.winmx.com
    O1 - Hosts: 209.67.209.50 c3318.z1301.winmx.com
    O1 - Hosts: 212.227.64.159 c3319.z1301.winmx.com
    O1 - Hosts: 205.238.40.2 c3310.z1302.winmx.com
    O1 - Hosts: 67.18.233.36 c3311.z1302.winmx.com
    O1 - Hosts: 82.43.224.20 c3312.z1302.winmx.com
    O1 - Hosts: 209.67.209.50 c3313.z1302.winmx.com
    O1 - Hosts: 212.227.64.159 c3314.z1302.winmx.com
    O1 - Hosts: 205.238.40.2 c3315.z1302.winmx.com
    O1 - Hosts: 67.18.233.36 c3316.z1302.winmx.com
    O1 - Hosts: 82.43.224.20 c3317.z1302.winmx.com
    O1 - Hosts: 209.67.209.50 c3318.z1302.winmx.com
    O1 - Hosts: 212.227.64.159 c3319.z1302.winmx.com
    O1 - Hosts: 82.43.224.20 c3310.z1303.winmx.com
    O1 - Hosts: 67.18.233.36 c3311.z1303.winmx.com
    O1 - Hosts: 205.238.40.2 c3312.z1303.winmx.com
    O1 - Hosts: 82.43.224.20 c3313.z1303.winmx.com
    O1 - Hosts: 67.18.233.36 c3314.z1303.winmx.com
    O1 - Hosts: 205.238.40.2 c3315.z1303.winmx.com
    O1 - Hosts: 82.43.224.20 c3316.z1303.winmx.com
    O1 - Hosts: 67.18.233.36 c3317.z1303.winmx.com
    O1 - Hosts: 205.238.40.2 c3318.z1303.winmx.com
    O1 - Hosts: 82.43.224.20 c3319.z1303.winmx.com
    O1 - Hosts: 205.238.40.2 c3310.z1304.winmx.com
    O1 - Hosts: 67.18.233.36 c3311.z1304.winmx.com
    O1 - Hosts: 82.43.224.20 c3312.z1304.winmx.com
    O1 - Hosts: 209.67.209.50 c3313.z1304.winmx.com
    O1 - Hosts: 212.227.64.159 c3314.z1304.winmx.com
    O1 - Hosts: 205.238.40.2 c3315.z1304.winmx.com
    O1 - Hosts: 67.18.233.36 c3316.z1304.winmx.com
    O1 - Hosts: 82.43.224.20 c3317.z1304.winmx.com
    O1 - Hosts: 209.67.209.50 c3318.z1304.winmx.com
    O1 - Hosts: 212.227.64.159 c3319.z1304.winmx.com
    O1 - Hosts: 205.238.40.2 c3310.z1305.winmx.com
    O1 - Hosts: 67.18.233.36 c3311.z1305.winmx.com
    O1 - Hosts: 82.43.224.20 c3312.z1305.winmx.com
    O1 - Hosts: 209.67.209.50 c3313.z1305.winmx.com
    O1 - Hosts: 212.227.64.159 c3314.z1305.winmx.com
    O1 - Hosts: 205.238.40.2 c3315.z1305.winmx.com
    O1 - Hosts: 67.18.233.36 c3316.z1305.winmx.com
    O1 - Hosts: 82.43.224.20 c3317.z1305.winmx.com
    O1 - Hosts: 209.67.209.50 c3318.z1305.winmx.com
    O1 - Hosts: 212.227.64.159 c3319.z1305.winmx.com
    O1 - Hosts: 205.238.40.2 c3310.z1306.winmx.com
    O1 - Hosts: 67.18.233.36 c3311.z1306.winmx.com
    O1 - Hosts: 82.43.224.20 c3312.z1306.winmx.com
    O1 - Hosts: 209.67.209.50 c3313.z1306.winmx.com
    O1 - Hosts: 212.227.64.159 c3314.z1306.winmx.com
    O1 - Hosts: 205.238.40.2 c3315.z1306.winmx.com
    O1 - Hosts: 67.18.233.36 c3316.z1306.winmx.com
    O1 - Hosts: 82.43.224.20 c3317.z1306.winmx.com
    O1 - Hosts: 209.67.209.50 c3318.z1306.winmx.com
    O1 - Hosts: 212.227.64.159 c3319.z1306.winmx.com
    O1 - Hosts: 205.238.40.2 c3520.z1301.winmx.com
    O1 - Hosts: 67.18.233.36 c3521.z1301.winmx.com
    O1 - Hosts: 82.43.224.20 c3522.z1301.winmx.com
    O1 - Hosts: 209.67.209.50 c3523.z1301.winmx.com
    O1 - Hosts: 212.227.64.159 c3524.z1301.winmx.com
    O1 - Hosts: 205.238.40.2 c3525.z1301.winmx.com
    O1 - Hosts: 67.18.233.36 c3526.z1301.winmx.com
    O1 - Hosts: 82.43.224.20 c3527.z1301.winmx.com
    O1 - Hosts: 209.67.209.50 c3528.z1301.winmx.com
    O1 - Hosts: 212.227.64.159 c3529.z1301.winmx.com
    O1 - Hosts: 205.238.40.2 c3520.z1302.winmx.com
    O1 - Hosts: 67.18.233.36 c3521.z1302.winmx.com
    O1 - Hosts: 82.43.224.20 c3522.z1302.winmx.com
    O1 - Hosts: 209.67.209.50 c3523.z1302.winmx.com
    O1 - Hosts: 212.227.64.159 c3524.z1302.winmx.com
    O1 - Hosts: 205.238.40.2 c3525.z1302.winmx.com
    O1 - Hosts: 67.18.233.36 c3526.z1302.winmx.com
    O1 - Hosts: 82.43.224.20 c3527.z1302.winmx.com
    O1 - Hosts: 209.67.209.50 c3528.z1302.winmx.com
    O1 - Hosts: 212.227.64.159 c3529.z1302.winmx.com
    O1 - Hosts: 205.238.40.2 c3520.z1303.winmx.com
    O1 - Hosts: 67.18.233.36 c3521.z1303.winmx.com
    O1 - Hosts: 82.43.224.20 c3522.z1303.winmx.com
    O1 - Hosts: 209.67.209.50 c3523.z1303.winmx.com
    O1 - Hosts: 212.227.64.159 c3524.z1303.winmx.com
    O1 - Hosts: 205.238.40.2 c3525.z1303.winmx.com
    O1 - Hosts: 67.18.233.36 c3526.z1303.winmx.com
    O1 - Hosts: 82.43.224.20 c3527.z1303.winmx.com
    O1 - Hosts: 209.67.209.50 c3528.z1303.winmx.com
    O1 - Hosts: 212.227.64.159 c3529.z1303.winmx.com
    O1 - Hosts: 205.238.40.2 c3520.z1304.winmx.com
    O1 - Hosts: 67.18.233.36 c3521.z1304.winmx.com
    O1 - Hosts: 82.43.224.20 c3522.z1304.winmx.com
    O1 - Hosts: 209.67.209.50 c3523.z1304.winmx.com
    O1 - Hosts: 212.227.64.159 c3524.z1304.winmx.com
    O1 - Hosts: 205.238.40.2 c3525.z1304.winmx.com
    O1 - Hosts: 67.18.233.36 c3526.z1304.winmx.com
    O1 - Hosts: 82.43.224.20 c3527.z1304.winmx.com
    O1 - Hosts: 209.67.209.50 c3528.z1304.winmx.com
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
    O4 - HKLM\..\Run: [IEOptimizer] Kizlo.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\RunServices: [IEOptimizer] Kizlo.exe
    O4 - HKCU\..\RunServices: [IEOptimizer] Kizlo.exe
    O4 - Global Startup: BTTray.lnk = ?
    O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O14 - IERESET.INF: START_PAGE_URL=http://portal.v21.co.uk
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{C6C632C8-153C-4F17-816E-EDAA637D2B62}: NameServer = 62.41.128.51 62.41.128.52
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Windows Archiver (winarc) - Unknown owner - C:\WINDOWS\windat.exe (file missing)

  • #2
    Supreme Master coder! _Aerospace_Eng_'s Avatar
    Join Date
    Dec 2004
    Location
    In a place far, far away...
    Posts
    19,291
    Thanks
    2
    Thanked 1,043 Times in 1,019 Posts
    The v21 and the partypoker items are the ones that stand out to me. Unless you play partypoker it shouldn't be on your system. v21 may be some software of yours but it doesn't seem like its necessary to run. It also looks like they tried to set your homepage for you but again this could be your doing not sure.
    ||||If you are getting paid to do a job, don't ask for help on it!||||

  • #3
    Senior Coder crmpicco's Avatar
    Join Date
    Jan 2005
    Location
    Mauchline, Scotland
    Posts
    1,097
    Thanks
    15
    Thanked 1 Time in 1 Post
    >>>>The v21 and the partypoker items are the ones that stand out to me. Unless you play partypoker it shouldn't be on your system. v21 may be some software of yours but it doesn't seem like its necessary to run. It also looks like they tried to set your homepage for you but again this could be your doing not sure.

    Thanks AeroSpace,

    The v21 is (vTwoOne) the ISP. So that is 100% Safe.
    The partypoker is 100% Safe as I play it.
    The homepage seems to be working OK though.

    I was told elsewhere to remove any that said 'File Missing', which I did.

    Picco

  • #4
    Senior Coder crmpicco's Avatar
    Join Date
    Jan 2005
    Location
    Mauchline, Scotland
    Posts
    1,097
    Thanks
    15
    Thanked 1 Time in 1 Post
    is it just the entries marked "(file missing)" that i should remove?

    Picco

  • #5
    Senior Coder crmpicco's Avatar
    Join Date
    Jan 2005
    Location
    Mauchline, Scotland
    Posts
    1,097
    Thanks
    15
    Thanked 1 Time in 1 Post
    are there any experts on HijackThis?

  • #6
    Supreme Master coder! _Aerospace_Eng_'s Avatar
    Join Date
    Dec 2004
    Location
    In a place far, far away...
    Posts
    19,291
    Thanks
    2
    Thanked 1,043 Times in 1,019 Posts
    Remove the missing file ones, and look into the kizlo.exe ones. They say its an "IE optimizer" though I've never heard of such thing and really how "optimized" can you make IE, its already bad as it is.
    ||||If you are getting paid to do a job, don't ask for help on it!||||

  • #7
    Senior Coder crmpicco's Avatar
    Join Date
    Jan 2005
    Location
    Mauchline, Scotland
    Posts
    1,097
    Thanks
    15
    Thanked 1 Time in 1 Post
    turns out kizlo.exe is a virus. for anyone looking for info in the future - remove it.

  • #8
    Senior Coder JamieR's Avatar
    Join Date
    Oct 2004
    Location
    United Kingdom
    Posts
    3,161
    Thanks
    0
    Thanked 5 Times in 5 Posts
    Yeah, it's some kind of trojan. Make sure you run an updated AVG virus scan or whatever to ensure that your system is malware free. Run other tools such as spybot and adaware as well.

  • #9
    New to the CF scene
    Join Date
    Jan 2006
    Posts
    9
    Thanks
    0
    Thanked 0 Times in 0 Posts
    This program is malware and is not considered safe, it is part of a Malware group sometimes referred to as Covert.Sys.Exec. It should be Jailed:
    http://virusinfo.prevx.com/pxparall....XC=1b3a9740940
    Life is not measured by the breaths we take, but by the moments that take our breath away.


  •  

    Posting Permissions

    • You may not post new threads
    • You may not post replies
    • You may not post attachments
    • You may not edit your posts
    •