Hello,
Can somebody help me? This is the first time I use HijackThis.
I try to rescue a computer. The symptoms are:
- The default start page of Internet Explorer is http://24-7-search.com/
- The antivirus found a lot of virus when I connect to internet. Antivirus is OfficeScan - Trend Micro. The virus of this day are: CHM_MINER.A, JAVA_BYTEVER.A, JS_DIALOGARG.A, JS_SMALL.D, REG_PORSEKS.A, TROJ_AGENT.JI, TROJ_HIDEDI.A, TROJ_SMALL.AH, TROJ_SPYRE.B.
- The log is the folowing:
Thanks in advance.
Code:Logfile of HijackThis v1.99.0 Scan saved at 15:20:40, on 14/01/2005 Platform: Windows 2000 SP3 (WinNT 5.00.2195) MSIE: Unable to get Internet Explorer version! Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spoolsv.exe C:\WINNT\System32\svchost.exe C:\OfficeScan NT\ntrtscan.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\OfficeScan NT\tmlisten.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\system32\svchost.exe C:\WINNT\Explorer.EXE C:\OfficeScan NT\ofcdog.exe C:\OfficeScan NT\PCCNTMON.EXE C:\WINNT\Guard.exe C:\WINNT\winhost.exe C:\WINNT\winhost.exe C:\WINNT\winhost.exe C:\WINNT\System32\atiptaxx.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\WINNT\System32\taskmgr.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE Y:\Downloaded applications\Anti spyware\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://24-7-search.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://24-7-search.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http://SRV:8080 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *new-search.net*;*x-google.net* R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe" -HideWindow O4 - HKLM\..\Run: [tibs3] C:\WINNT\System32\tibs3.exe O4 - HKLM\..\Run: [MSUpdSrv] msupdsrv.exe O4 - HKLM\..\Run: [securer] C:\WINNT\System32\securer\syshost.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm O16 - DPF: {11111111-1111-1111-1100-000000000000} - file://C:\Program Files\Internet Explorer\iexplorer.exe O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:\foo.mht!http://82.179.166.145/x24.chm::/trs24.exe O16 - DPF: {2A32B14F-4D29-4EA3-AC54-E9B19F436CE7} (Scanner Class) - http://www.windowsecurity.com/trojanscan/TDECntrl.CAB O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = spfmt.corp O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = spfmt.corp O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = spfmt.corp O23 - Service: Avertissement - Unknown - C:\WINNT\System32\services.exe O23 - Service: Gestion d'applications - Unknown - C:\WINNT\system32\services.exe O23 - Service: Explorateur d'ordinateur - Unknown - C:\WINNT\System32\services.exe O23 - Service: Client DHCP - Unknown - C:\WINNT\System32\services.exe O23 - Service: Service d'administration du Gestionnaire de disque logique - Unknown - C:\WINNT\System32\dmadmin.exe O23 - Service: Gestionnaire de disque logique - Unknown - C:\WINNT\System32\services.exe O23 - Service: Client DNS - Unknown - C:\WINNT\System32\services.exe O23 - Service: Journal des événements - Unknown - C:\WINNT\system32\services.exe O23 - Service: Service de télécopie - Unknown - C:\WINNT\system32\faxsvc.exe O23 - Service: Serveur - Unknown - C:\WINNT\System32\services.exe O23 - Service: Station de travail - Unknown - C:\WINNT\System32\services.exe O23 - Service: Service d'application d'assistance TCP/IP NetBIOS - Unknown - C:\WINNT\System32\services.exe O23 - Service: Affichage des messages - Unknown - C:\WINNT\System32\services.exe O23 - Service: Partage de Bureau à distance NetMeeting - Unknown - C:\WINNT\System32\mnmsrvc.exe O23 - Service: DDE réseau - Unknown - C:\WINNT\system32\netdde.exe O23 - Service: DSDM DDE réseau - Unknown - C:\WINNT\system32\netdde.exe O23 - Service: Ouverture de session réseau - Unknown - C:\WINNT\System32\lsass.exe O23 - Service: Fournisseur de la prise en charge de sécurité LM NT - Unknown - C:\WINNT\System32\lsass.exe O23 - Service: OfficeScanNT RealTime Scan - Trend Micro Inc. - C:\OfficeScan NT\ntrtscan.exe O23 - Service: Plug-and-Play - Unknown - C:\WINNT\system32\services.exe O23 - Service: Agent de stratégie IPSEC - Unknown - C:\WINNT\System32\lsass.exe O23 - Service: Emplacement protégé - Unknown - C:\WINNT\system32\services.exe O23 - Service: Gestionnaire de comptes de sécurité - Unknown - C:\WINNT\system32\lsass.exe O23 - Service: Prise en charge des cartes à puces - Unknown - C:\WINNT\System32\SCardSvr.exe O23 - Service: Carte à puce - Unknown - C:\WINNT\System32\SCardSvr.exe O23 - Service: Planificateur de tâches - Unknown - C:\WINNT\system32\MSTask.exe O23 - Service: Service d'exécution par délégation - Unknown - C:\WINNT\system32\services.exe O23 - Service: Journaux et alertes de performance - Unknown - C:\WINNT\system32\smlogsvc.exe O23 - Service: Telnet - Unknown - C:\WINNT\system32\tlntsvr.exe O23 - Service: OfficeScanNT Listener - Unknown - C:\OfficeScan NT\tmlisten.exe O23 - Service: Client de suivi de lien distribué - Unknown - C:\WINNT\system32\services.exe O23 - Service: Gestionnaire d'utilitaires - Unknown - C:\WINNT\System32\UtilMan.exe O23 - Service: Horloge Windows - Unknown - C:\WINNT\System32\services.exe O23 - Service: Infrastructure de gestion Windows - Unknown - C:\WINNT\System32\WBEM\WinMgmt.exe O23 - Service: Extensions du pilote WMI - Unknown - C:\WINNT\system32\Services.exe
