Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

HijackThis Log: Please help Diagnose


  • This topic is locked This topic is locked
4 replies to this topic

#1 teerkas

teerkas

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:11:39 PM

Posted 05 October 2004 - 07:56 PM

Hello

This is my first attempt to use HijackThis. Here's the log Please help me disgnosis it. I'm worried about entry
O4 - HKLM\..\RunServices: [zervpack2] update2.exe

Using process explorer, I've seen this process runnign quite a few number of times. I tried searching it in vain. Adaware, Sysweeper or Sybot S&D have not reported any suspecious activity. However, I've oberved that whenever this process is running, new IE window is opened and tries to access rev2. Also, security settings for Internet zone gets reset to Custom.

Logfile of HijackThis v1.97.7
Scan saved at 8:53:15 PM, on 10/5/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\BR\Desktop\procexp.exe
C:\Documents and Settings\BR\Desktop\sysinternals\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.siddhivinayak.org/index1.html
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [XML Service] msxml.exe
O4 - HKLM\..\RunServices: [zervpack2] update2.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html

BC AdBot (Login to Remove)

 


#2 ~Ayeka~

~Ayeka~

    Princess of Jurai


  • Members
  • 580 posts
  • OFFLINE
  •  
  • Local time:06:39 PM

Posted 05 October 2004 - 09:36 PM

Hi teerkas,
Welcome to BC!

Be sure your system is configured to show hidden files.

Run HijackThis and put a check in the boxes next to the following:
O4 - HKLM\..\RunServices: [XML Service] msxml.exe
O4 - HKLM\..\RunServices: [zervpack2] update2.exe


Close all browsers and windows (except for HijackThis) and click Fix checked

Reboot into Safe Mode.

Go to Start > Search > All files and folders. Search for and delete the following files:
msxml.exe
update2.exe


Reboot normally.

The version of HijackThis that you are running is outdated. The latest version is HijackThis 1.98.2, which you can download from here: http://www.bleepingcomputer.com/files/Merijn/HijackThis.zip and unzip it to your C:\Documents and Settings\BR\Desktop\sysinternals\HijackThis folder.

Then, run HijackThis and post a new log here.

Edited by ~Ayeka~, 06 October 2004 - 07:28 AM.


#3 teerkas

teerkas
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:11:39 PM

Posted 07 October 2004 - 06:02 AM

Hmm... I tried that and here's the log. I guess I got rid of those 2 .exe files. Thanks man and let me know if I need to do anything more...

Logfile of HijackThis v1.98.2
Scan saved at 7:01:15 AM, on 10/7/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Documents and Settings\BR\Desktop\procexp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\BR\Desktop\sysinternals\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.siddhivinayak.org/index1.html
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html

Do I need the following processes running ?
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\WBEM\WinMgmt.exe

#4 ~Ayeka~

~Ayeka~

    Princess of Jurai


  • Members
  • 580 posts
  • OFFLINE
  •  
  • Local time:06:39 PM

Posted 08 October 2004 - 05:53 AM

Hi again teerkas,
Sorry for the delay.

The files that you asked about are both legitimate files and should be left alone. Below is a brief description of both of them

spoolsv.exe <--a Microsoft Windows system executable which handles the printing process to your local printers.

WinMgmt.exe <--the Windows Management Instrumentation. It is used by system administrators to create Windows management scripts, for example, scripts that handles the user accounts on a server.

Other than that, your log is clean, great job! Follow these steps to ensure that your system is protected from future attacks:
Download & install these programs:
IE-SPYAD <--adds a long list of sites and domains associated with known advertisers, marketers, and crapware pushers to the Restricted sites zone of Internet Explorer
Spyware Blaster <--Prevents the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted pests; blocks spyware/tracking cookies in Internet Explorer and Mozilla/Firefox; restricts the actions of potentially dangerous sites in Internet Explorer.

These recommendations are based on veteran spyware fighter Tony Klein's now classic article, So how did I get infected in the first place? Check it out for even more information and other helpful programs to prevent future attacks.

I also highly recommend the information in Bleepingcomputer's own Simple steps to keep your computer secure!, which includes helpful hints and programs.

Visit Windows Update regularly. Make sure that you always have all the Critical Updates recommended for your Operating System and Internet Explorer. The first defense against infection is a properly patched OS.
http://www.microsoft.com/windowsxp/sp2/topten.mspx

#5 ~Ayeka~

~Ayeka~

    Princess of Jurai


  • Members
  • 580 posts
  • OFFLINE
  •  
  • Local time:06:39 PM

Posted 01 November 2004 - 01:42 AM

Since your problem appears to be resolved, this thread will now be closed. If you need this topic reopened, please contact a member of the HJT Team and we will reopen it for you. Include the address of this thread in your request. If you should have a new issue, please start a new topic. This applies only to the original topic starter. Everyone else please begin a New Topic.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users