View Full Version : Hijack this please..


Alexis
03-21-2006, 12:18 PM
network and my computer have been running a little slow since last night. Go-fig. I'm thinking I should just do a complete spring cleaning of my computer? Did a speed test a pulled in 5361kpbs Down and 323kbps up. Go fig.

Also when i try to load a program it doesn't load it up or do anything. Like it waits and some of the other programs get stuck, but not like a crash they just won't react to the commands i do. Then eveything loads up real fast and all the commands i tryed to enter take action at once. Like let say i try to start IE i wait a while nothing, i press it 3 times more, nothing. After a while of waiting it'll open up 3 windows for IE.

Logfile of HijackThis v1.99.1
Scan saved at 9:21:11 AM, on 3/21/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\Documents and Settings\Alexis Martinez\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ycomp_adbe/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp_adbe/defaults/sp/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finance.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [EPSON Stylus C84 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2D1.EXE /P23 "EPSON Stylus C84 Series" /O6 "USB001" /M "Stylus C84"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1115959116015
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{626B5723-88DB-4B52-8677-5D141E6E4FA9}: NameServer = 204.127.198.4,63.240.76.4
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

shifty
03-21-2006, 02:01 PM
your problem is norton internet security. i gaurantee you if you remove it, reboot, the problem will be gone.

unplug your computer from the network, uninstall NIS, reboot, check it out. reboot again just to make sure that it's not "cleaning up" after the uninstall, and slowing things down ... just to be thorough.

i have run into this happening recently with 3 other computers running NIS. it's a crappy product. the services loading at boot are causing your problem - look at it - there's like 10 of them in the services list - most people have max of 5-7 services total, your has like 20 thanks to Norton.

Alexis
03-21-2006, 02:18 PM
as much as I would do what you tell me. norton is my firewall. What am I going to do about a firewall?

I get a couple of hits a day from some dickheads in japan, korea, china, etc. trying to tap into my computer.

i swear if i ever meet any of these guys...................

HotRod71
03-21-2006, 02:21 PM
Don't know just how good it is but SP 2 for WinXP has a built in firewall. Macafee has a firewall also. You could get a firewall router also. But I am sure that Shifty can answer a little better than me. He deals with it more than me.

shifty
03-21-2006, 05:57 PM
You wo't meet those guys. XP's built in firewall can be found in the Control Panel under "Windows Firewall" icon (it's only listed in the Control Panel if you're using SP2). Turn it on in the meantime.

XP's built-in firewall blocks people from getting INTO your computer, whereas aftermarket programs like NIS keep people from getting INTO or OUT OF your computer...so you stop traffic flow both ways. This is added security for you to make sure you don't install something bad on your system and have it "call home" with precious information like usernames and passwords to login to your system. This is a rare chance, but ... some people like that added security to know what programs on the computer are "calling out" and stop them if it's decided it's a bad behavior.

If you want an aftermarket firewall, I suggest using Kerio's firewall. You can get it free through Sunbelt Software. It's a free download, I am not certain how long the trial period lasts or if you can continue using after the trial period. I say try it and if you like it, use it. I think Zone Alarm has a "personal edition" free firewall you can use also, I just don't like their product as much as Kerio's.

For free antivirus, AVG is excellent and free: http://free.grisoft.com ... do not download the "trial" version, get the "free" version. They make the links confusing, probably on purpose, but whatever.

Also, NOD32 is a great pay antivirus software @$30 roughly, but beware, while it IS the best on the market for all users, it will conflict with Google Desktop software if you use that program beware (not the toolbar, the dekstop software).

shifty
03-21-2006, 05:58 PM
PS - if you have a properly configured aftermarket router, it acts as a hardware firewall also if you have NAT turned on.

Alexis
03-22-2006, 09:55 AM
well it's faster thats for sure :cool: ......

I got windows XPs firewall running.

but taking out norton internet secruity also took out my norton anti-virus. Was that suppose to happen?

shifty
03-22-2006, 10:29 AM
yes. unfortunately Norton bundles it all together into one big unit, which is big appeal to most home users who don't want to research what products to use OR don't want to spend $90 to do things the right way after researching. that bundling together is also part of the reason it will bring yoru system to a crawl. even with 1GB or more of RAM, it gets bad and slows you down with NIS.

the removal of NIS removes their online surfing defenses, antivirus, firewall and other internet related securities and features such as "password keeper" or whatever that service is. honestly, you can cover all of your bases with free software if you wanted, you'll just install it separately instead of one unit - the benefit is, your system won't be bloated and overloaded (and slow to boot) like it is with NIS.

i would even consider using just Norton Antivirus in its standalone version - it's not a HORRIBLE program, but if you wanted to pay for something out there, I would go with NOD32 (if you're not using Google Desktop) first, alternate choices are Panda's antivirus, Trend's PC-Cillin standalone scanner is also very good. Any of these should work fine for you, but its important you only use one antivirus program on your system at any given time (sorry if you already know this, i had to edit and add this in)

again, for firewalls, the only two names i know and respect to any degree are Zonealarm (might be easier to setup these days) or, for utter easiness, the Kerio Personal Firewall (Sunbelt software) is unsurpassable IMHO. i recommend it to all family and friends. Kerio's firewall comes with built-in internet security like .. popup blocking if i remember correctly (SP2 for XP also has this), which will keep you safe.

for popup blockers and spyware/trojan/adware/malware sweeping, SpySweeper has a great real-time scanner and it's really a good program if you were only to use one application. it really requires two applications minimum to protect against spyware - there is no real "catch all" spyware application out on the market, it's not like antivirus software. if i were to bundle it with anything that would really make me feel comfortable, i would probably purchase Ewido Security Suite.

a good pay combination, IMO, low resource intensive, that will really keep you mostly clean and safe (almost to overkill) would be one of the antivirus products listed above + the firewall + spysweeper + ewido. you could toss on scans with AdAware SE or Spybot S&D occasionally for backup (both are free) or use those in the place of SpySweeper (i just prefer SpySweeper's realtime scanner).

a good free combination, IMO, low resource intensive, that will really keep you mostly clean and safe would be using AVG antivirus's free software + Zone Alarm *or* Kerio (i think they each have a free client, don't sue me if i'm wrong) + AdAware SE and/or Spybot S&D.

new attacks on Windows based computers come out every day, however. the next big thing will be "rootkits" which are programs which install themselves on yoru computer and is completely invisible (it installs super easily if you don't do Windows Updates, install your service pack upgrades or you download free software, do filesharing, gamble online or look at porn a lot). there are several levels to rootkits and several types that are virtually (if not totally) undetectable in the current versions of Windows and can do serious damage and give people full access to your system. it will be interesting to see how PC protection changes in the next 2-3 years to counter these types of infections.