hijackthis log

[mbandela000]

hey guys, is there something wrong with this,
i have some spyware that wont let me open task manager, i formated, but it still is there, i dont know what to do. i ran hijack this, here is the log

Logfile of HijackThis v1.99.1
Scan saved at 9:19:02 PM, on 8/12/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\System32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\System32\ssmss.exe
D:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
D:\Program Files\AIM\aim.exe
D:\Program Files\BitLord\BitLord.exe
E:\install.exe
E:\setup2D.exe
D:\Documents and Settings\James\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IE6] ssmss.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] "D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\RunServices: [IE6] ssmss.exe
O4 - HKCU\..\Run: [Steam] D:\Program Files\Valve\Steam\Steam.exe -silent
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [AIM] D:\Program Files\AIM\aim.exe -cnetwait.odl
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - D:\Program Files\AIM\aim.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe

please help me out, thx

[Martoch]

http://www.techimo.com/forum/t137826.html



What programs have you used to scan your system?

Try these if you haven't already:

Adaware
http://www.download.com/Ad-Aware-SE-...-10045910.html

Spybot
http://www.download.com/Spybot-Searc...ml?tag=lst-0-1

Spy Sweeper
http://www.download.com/Webroot-Spy-...-10373771.html

Spyware Doctor
http://www.download.com/Spyware-Doct...-10377263.html

Microsoft Antispyware Beta
http://www.download.com/Microsoft-Wi...ml?tag=lst-0-1

A-Squared
http://www.emsisoft.com/en/software/download/

CWShredder
http://www.softpedia.com/get/Interne...Shredder.shtml

Ewido Security Suite
http://www.download.com/Ewido-Securi...-10326287.html



Install them, update them, reboot into safe mode, run complete system scans.
(Spyware Doctor, Spy Sweeper, and Ewido are trial versions, but are fully functional...just uninstall them when you're done scanning/removing spyware)

Report back with your findings.

What all do you have starting up with Windows? You can run a simple startup detection program to help you find out.
Autoruns
http://www.sysinternals.com/ntw2k/fr...autoruns.shtml

[Christian-Comp]

Turn off system restore - go into safemode - check out your msconfig (start-run-msconfig-enter) - startup tab - make sure only legit programs are starting.

Run spybot, adaware, a good antivirus like AVG - then hijack this again.

It might help. I see this a lot when working on systems from our dial-up and cable modem customers.

[mbandela000]

i read the hijackthis log, i tried deleteing the problem, but it says access denied

[Martoch]

Okay, since you don't feel like reading the hijackthis tutorial I pointed you to...

Quote:

At times you may find a file that stubbornly refuses to be deleted by conventional means. HijackThis introduced, in version 1.98.2, a method to have Windows delete the file as it boots up, before the file has the chance to load.

How to delete files on reboot

[1989lx50]

Hello all,
I am new to this site, and am in the process of extricating some spyware from my computer. I am somewhat of a computer rookie, and have followed the steps outlined above, except for the hijack part.

What are my hijack options? I looked around, and all the sites I found seem to want money to download the program. Is this correct? If not, where do I find the original program?

Any info would be a huge help.

thx,

shawn

[andy1984]

you should start a new thread btw, but here you go
http://www.download.com/HijackThis/3...-10227353.html

[27]

SSSLAM your log file into both of these

http://hjt.iamnotageek.com/

http://www.hijackthis.de/

They'll tell you which pieces of eeevil to delete.

Restart your compurah and do it again.

If you still have problems after this, let us know.