Post Your HijackThis logs here - Page 5

**Zap** · 05-09-2006, 05:29 PM

Quote:

Originally Posted by cashcannon

it found zero virusses, and cpu didnt freak out, Im going to bed now

thanks alot for the trouble!

NP.

Tomassi · 05-10-2006, 10:49 AM

I now know whats causing the 100% cpu usage, believe it or not its Avira
latest update build 151 has a avnotify.exe that causes the overusage of cpu,
hopefully they will fix it soon!

**Zap** · 05-10-2006, 10:57 AM

Quote:

Originally Posted by cashcannon

I now know whats causing the 100% cpu usage, believe it or not its Avira
latest update build 151 has a avnotify.exe that causes the overusage of cpu,
hopefully they will fix it soon!

You should notify them, in case they don't know.

Tomassi · 05-10-2006, 12:11 PM

Antivir knows, a lot of other forums already notified them

Jimmy2 · 06-19-2006, 09:52 AM

I have this spyware quake that has infected our system spywarequake.com
any suggestions on how to get rid of it?

**Zap** · 06-19-2006, 10:00 AM

@Jimmy2: Could you please post a hijackthis! log?

Jimmy2 · 06-19-2006, 10:03 AM

The last time I did that I did it incorrectly, could you give me a few pointers please

**Zap** · 06-19-2006, 10:05 AM

Quote:

Originally Posted by Jimmy2

The last time I did that I did it incorrectly, could you give me a few pointers please

Sure. Just read the very first message in this thread. G10 and NeO have created a great tutorial.

Jimmy2 · 06-19-2006, 10:32 AM

I think it should be here

**Zap** · 06-19-2006, 11:15 AM

Your hijackthis! log looks clean.

You may find the information you're looking for here.

Abhishek · 06-19-2006, 10:42 PM

Here are mine, HEEEEEEEEEEEEEEEEEEEEEELp

NeO · 06-20-2006, 11:01 AM

Your log file looks clean to me... I would re-scan and delete this file...

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm (file missing)

What seems to be the problem otherwise?

NeO

pukenerampa · 06-29-2006, 08:23 PM

heres mine. thanks in advance

Logfile of HijackThis v1.99.1
Scan saved at 10:12:01 AM, on 6/30/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HHVcdV5Sys\VC5SecS.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Yahoo!\Messenger\YPager.exe
D:\new hijack\HijackThis.exe

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{FB8A6848-B7E1-49B5-B0C1-FCCA9C0D2A8E}: NameServer = 202.78.97.41 202.78.97.3
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Virtual CD v5 Security service (VC5SecS) - H+H Software GmbH - C:\Program Files\HHVcdV5Sys\VC5SecS.exe

uhm how can i attach a notepad?

**Zap** · 06-29-2006, 09:56 PM

@Puken: You can delete the following...

O8 - Extra context menu item: &Clean Traces - C:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\Program Files\DAP\dapextie2.htm
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

pukenerampa · 06-30-2006, 12:23 AM

thanks zap. do my dap will still work if i have remove those?

**Zap** · 06-30-2006, 08:23 AM

Quote:

Originally Posted by pukenerampa

thanks zap. do my dap will still work if i have remove those?

No. I have seen mixed reviews about it, though. I recommended removal because not eveyone seems to have a positive opinion of that software. You can leave it in, but if you are having problems, that is where I'd start looking first.

dgeeper · 07-11-2006, 06:43 PM

Help!

chicgeek · 07-26-2006, 07:31 AM

I don't know if anyone is still doing this, but I'm always up for cleaning things off of my PCs. Any advice for my work compy?:

**Zap** · 07-26-2006, 10:17 AM

@Cheeks: You can get rid of the following...

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

They won't hurt your system, but they are not necessary.

My own personal preference would be to also uninstall the Yahoo toolbar.

...and... what is this and why is it running...
C:\WINDOWS\TEMP\XQCA13.EXE

chicgeek · 07-26-2006, 10:52 AM

Oh eww, how did that get there?

And any chance the sun one is somehow vital? It's my work computer, highly networked, blah blah blah.