Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HJT log.


  • This topic is locked This topic is locked
2 replies to this topic

#1 jinky67

jinky67

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:06:52 PM

Posted 14 July 2005 - 04:53 AM

Hi, im having trouble removing two processes from my task manager, they are 'iexplore.exe', i cant find a solution to properly remove this, which led me to HJT, evn if this doesnt help remove it, im sure posting my log wont do any harm.

Any help or ideas on this 'iexplore.exe' would be greatly appreiciated, ive ran, Spybot S&D, adaware and my AV. nothing. i also deleted the file from my 'Windows/prefetch. still nothing.

Thanks.



Logfile of HijackThis v1.99.1
Scan saved at 10:50:13, on 14/07/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Sygate\SPF\smc.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
D:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\UAService7.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\rundll32.exe
D:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
D:\Program Files\Internet Explorer\iexplore.exe
d:\progra~1\intern~1\iexplore.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Tools\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.cbeuqkocckdpgodwifdzc.com/8Ci1F...As2ozukhFJ.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ttqfvwtyzmvb.us/8Ci1FaF08Ih9qxE...0_7A2MtpZ4.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\Tools\Spybot\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7B6B6BC8-D81E-53A9-C136-C5B7165AE4E4} - D:\DOCUME~1\colin\APPLIC~1\AXISBR~1\Great new.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [SmcService] D:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [C-Media Speaker Configuration] \Setup.exe /SPEAKER
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Coal Bows Ref Grid] D:\Documents and Settings\All Users\Application Data\tray bold coal bows\twomanager.exe
O4 - HKCU\..\Run: [trust delete] D:\DOCUME~1\colin\APPLIC~1\grimbeep\name free.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mov: D:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mpeg: D:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30CE93AE-4987-483C-9ABE-F2BD5301AB70} - http://64.158.165.49/output/100039/uk/dbgames/dbaccess.exe
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppD...sharingctrl.cab
O20 - AppInit_DLLs: MsgPlusLoader.dll
O23 - Service: Ati HotKey Poller - Unknown owner - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - D:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - D:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - D:\Program Files\Sygate\SPF\smc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - D:\WINDOWS\system32\UAService7.exe

Thanks again.

BC AdBot (Login to Remove)

 


#2 ddeerrff

ddeerrff

    Retired


  • Malware Response Team
  • 2,724 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Upper Midwest, US
  • Local time:06:52 PM

Posted 15 July 2005 - 11:39 PM

Hello jinky67 and welcome to BleepingComputer.

iexplore.exe = Internet Explorer. I don't think you want to delete that.

==

Configure Windows to enable viewing of Hidden and System files.

Start HJT and click on the SCAN button. Put a check mark in front of the following lines if they still show:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.cbeuqkocckdpgodwifdzc.com/8Ci1F...As2ozukhFJ.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ttqfvwtyzmvb.us/8Ci1FaF08Ih9qxE...0_7A2MtpZ4.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank

O2 - BHO: (no name) - {7B6B6BC8-D81E-53A9-C136-C5B7165AE4E4} - D:\DOCUME~1\colin\APPLIC~1\AXISBR~1\Great new.exe

O4 - HKLM\..\Run: [Coal Bows Ref Grid] D:\Documents and Settings\All Users\Application Data\tray bold coal bows\twomanager.exe
O4 - HKCU\..\Run: [trust delete] D:\DOCUME~1\colin\APPLIC~1\grimbeep\name free.exe

O16 - DPF: {30CE93AE-4987-483C-9ABE-F2BD5301AB70} - http://64.158.165.49/output/100039/uk/dbgames/dbaccess.exe

O20 - AppInit_DLLs: MsgPlusLoader.dll

With ALL OTHER WINDOWS CLOSED, click on Fix Checked.

==

Open Windows Explorer (Windows key+e), navigate to and delete the following folders:

D:\Documents and Settings\colin\Application Data\AXISBR~1\ <-- "~1" indicates additional characters after the AXISBR
D:\Documents and Settings\colin\Application Data\grimbeep\
D:\Documents and Settings\All Users\Application Data\tray bold coal bows\

If any of these resist being deleted, boot into Safe Mode and try from there.

==

Open Notepad, (Start button, click on Run, type in Notepad, and click OK) copy & pastes the following block of text into Notepad.

dir c:\windows\tasks /a > sched.txt
notepad sched.txt
del sched.txt


Click on 'File', then 'Save as'
Select 'Save as type:' as All Files,
Save the file to the desktop as sched.bat. Close Notepad.

Double click on sched.bat and a notepad file should open. Copy the contents of that file to your next post.
Derfram
~~~~~~

#3 ddeerrff

ddeerrff

    Retired


  • Malware Response Team
  • 2,724 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Upper Midwest, US
  • Local time:06:52 PM

Posted 01 August 2005 - 12:32 PM

Due to inactivity, this thread will now be closed. If you need this topic reopened, please contact a member of the HJT Team and we will reopen it for you. Include the address of this thread in your request. If you should have a new issue, please start a new topic. This applies only to the original topic starter. Everyone else please begin a New Topic.
Derfram
~~~~~~




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users