republican-creole
Search:  

 
theme to black backgroundlet page decide theme
HomeFind ServiceReviewsISP NewsFAQsForumsToolsDatabaseAbout 
 
   All ForumsHot TopicsGallery






how-to block ads


 
Forums » Up and Running » Security » Security » Help With Hijack This Log/ Madfinder
Uniqs:
372		 Share Topic:
RSS topic:
toggle:
flat / full
normal / watch
Posting:
Post a:
Post a:
Links: ·Hijack This logs? ·Panda Free Tools ·Vundo Removal
Nachi the new champion bad boy »
« Anyone else having this BOClean problem?  

lilhurricane
Crunchin' For Cures
Premium,Mod
join:2003-01-11
Purple Zone
clubs:
·Comcast

Host:
TV over IP
Software
RCN
Inside Insight
Team Discovery

Help With Hijack This Log/ Madfinder


Found This
I downloaded the CWShredder, and it found 1 item Madfinder. It removed it. When I rebooted...there it was again.

I ran Hijack This and this is what I got.

Logfile of HijackThis v1.97.5
Scan saved at 3:02:59 PM, on 11/23/03
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\KERIO\PERSONAL FIREWALL\PERSFW.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\WINDOWS\STARTER.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGMAIN.EXE
C:\WINDOWS\DESKTOP\DISCOVERY\UNITED DEVICES\UD.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\DESKTOP\DISCOVERY\UNITED DEVICES\UD_1706422.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGBHP.EXE
C:\WINDOWS\DESKTOP\DISCOVERY\UNITED DEVICES\UD_1706422_0.DIR\UD_LIGFIT_RELEASE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Hurricane HSI
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE"
O4 - HKLM\..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\mcagent.exe
O4 - HKLM\..\Run: [VirusScan Online] "C:\PROGRA~1\MCAFEE.COM\VSO\mcvsshld.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\RunServices: [PersFw] "C:\PROGRAM FILES\KERIO\PERSONAL FIREWALL\PERSFW.EXE"
O4 - HKLM\..\RunServices: [McVsRte] C:\PROGRA~1\MCAFEE.COM\VSO\mcvsrte.exe /embedding
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: Shortcut to Ud.lnk = C:\WINDOWS\Desktop\DISCOVERY\United Devices\UD.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O16 - DPF: {0C568603-D79D-11D2-87A7-00C04FF158BB} (BrowseFolderPopup Class) - »download.mcafee.com/molbin/Share···wFld.cab
O16 - DPF: {6C636F50-7EB2-11D2-883C-CA8C113EA37E} (McAfee Clinic QuickClean Class) - »download.mcafee.com/molbin/Clini···cctl.cab
O16 - DPF: {23047A90-8511-11D2-87A5-20C252C10000} (McAfee Clinic TreeView Class) - »download.mcafee.com/molbin/Shared/MGTree.cab
O16 - DPF: {D30CAFF0-087B-11D3-82D8-006094695CEC} (McAfee PC Clinic FaManager Class) - »download.mcafee.com/molbin/Clini···actl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - »download.macromedia.com/pub/shoc···lash.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - »download.macromedia.com/pub/shoc···wdir.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - »bin.mcafee.com/molbin/shared/mci···sctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - »bin.mcafee.com/molbin/shared/mcg···dmgr.cab
O16 - DPF: {E9B2DC2F-3659-11D5-811E-00C0F003066B} (Cleaner Class) - »www.panicware.net/activex/pwiclean.cab
O16 - DPF: {CDB74794-A3BA-4733-B6F6-59BF16D6C15A} - »download.mcafee.com/molbin/mcaen···tshp.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - »v4.windowsupdate.microsoft.com/C···53900463

I would appreciate any advice you can offer. Thank you.
--
Proud Member of: Team Discovery Join Us!! HOPE!!
permalink · 2003-11-23 19:01:17 · Print · Reply to this

Vampirefo
Premium,MVM
join:2000-12-11
Huntington, WV

Re: Help With Hijack This Log/ Madfinder

It's a false alarm, read this thread.
»Madfinder: Keeps Coming Back
--
TrojanHunter Stands For Privacy!!!!!!!
permalink · 2003-11-23 19:20:37 · Reply to this

lilhurricane
Crunchin' For Cures
Premium,Mod
join:2003-01-11
Purple Zone
clubs:
·Comcast

Host:
TV over IP
Software
RCN
Inside Insight
Team Discovery

Re: Help With Hijack This Log/ Madfinder

Alright then, Vampirefo See Profile..that was what I thought. I needed reassurance is all, as I believed that to be an issue with XP only. Thanks very, very much!!!
--
Proud Member of: Team Discovery Join Us!! HOPE!!
permalink · 2003-11-23 19:22:49 · Reply to this
anthrorules
Premium
join:2003-09-14
Rollinsville, CO
·Qwest.net
·IonSKY

 Which version of CWShredder are you using?

If you are using a version older than the one released today, 1.36.0000, than it is definitely a false positive as VampireInfo mentioned.

This seems to have been fixed in the newest version, 1.36.0000.

Check your version, and update it if necessary, then run CWShredder again.
--
Earthlink/Direcway SRS - DW4000 | ver. 4.2.1.10 | Proxy/Port 83 | G4R | 1250 | Dell Dimension 4550 - WinXP Pro SP1 - 256MG Ram |ZA+ 4.5 | AVG 7.0 | Trojan Remover | Ad-Aware | SpyBot S&D | MailWasher Pro 3.2
permalink · 2003-11-23 19:23:27 · Print · Reply to this

lilhurricane
Crunchin' For Cures
Premium,Mod
join:2003-01-11
Purple Zone
clubs:
·Comcast

Host:
TV over IP
Software
RCN
Inside Insight
Team Discovery

Hooray!!!
Thank you as well, anthrorules See Profile
I am clean!!!
permalink · 2003-11-23 19:26:30 · Print · Reply to this

Bubba
GIT-R-DONE
Premium,MVM
join:2002-08-19
Around, Us
1 edit		 Sorry.....I can't even read a post right
permalink · 2003-11-23 19:31:38 · Reply to this
Forums » Up and Running » Security » SecurityNachi the new champion bad boy »
« Anyone else having this BOClean problem?  

Friday, 27-Nov 21:20:08 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 10 years online! © 1999-2009 dslreports.com.
page compression OFF
Most commented news this week
· [121] Time Warner Cable Fires Broadside At Broadcasters
· [112] New AT&T Ad Campaign Hits Back At Verizon
· [95] Apple Joins AT&T Verizon Snark Fest
· [87] New Bill Takes Aim At Higher Verizon ETFs
· [70] TiVo Sees Record Customer Losses
· [68] In-Flight Internet Headed For Bumpy Landing?
· [61] Verizon CEO: Hulu Will Be Dead Soon
· [60] Thanksgiving Open Thread
· [38] EFF Wages War On Fine Print
· [38] ICANN Slams DNS Redirection
Most people now reading
· Windows 7 boot manager editing questions [Microsoft Help]
· 3.x Feral Druid - Bear Tanking Guide [World of Warcraft]
· Only firefox accesses Internet? [Security]
· Blue Ray: Samsung BD-P3600 or LG BD390 [Audio/Video Chat]
· [ PVP] 3.2 DK PvP D/W Spec... [World of Warcraft]
· ToC 4th boss - Preliminary Strategy for Twin Valkyr [World of Warcraft]
· [Newsgroups] Newzleech down? [Filesharing Software]
· Question for DSL Co CEO's - Competition Bureau do u use it? [Canadian Broadband]
· What to use while demonoid is down? [Filesharing Software]
· [ Classes] Druid tanking: rotation and glyphs [World of Warcraft]