hijack this log

edifier · 11-11-2006, 07:44 PM

Even though you uninstalled Norton, there are still 2 Norton services running. Lets get rid of those and some other unnecessary startup items.Do the following. If you can access the below manually, take it out, if not, leave it.

Run HijackThis and put a check by the following entries, close all open windows and browsers except HijackThis and click 'Fix Checked'

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY... on&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TY... on&pf=lapto
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe
O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

You might have to go into your messengers and select disable at startup.

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\Go ogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavili on&pf=laptop

Exit 'HJT'.

On your desktop, click 'start/run' and type in services.msc and click okay.

Look for both of these entries.

Automatic LiveUpdate Scheduler or ALUSchedulerSvc.exe
Symantec Core LC or symlcsvc.exe

Select Stop/apply and okay.

Open HijackThis and select - Misc. Tools/Delete an NT Service

Type in one at a time -Automatic LiveUpdate Scheduler and Symantec Core LC - make sure the spelling is EXACT.

Don't reboot until both have been entered.

Now let's see if it starts up quicker now.

spkenn5 · 11-11-2006, 08:01 PM

symantec core LC is critical, couldnt be erased.

should i restart now?

edifier · 11-11-2006, 10:12 PM

Okay, try restarting.

computermaineack · 11-11-2006, 10:20 PM

Here's a few problems:

O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe - Virus

O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" - Possibly a Trojan

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) - Possibly Nasty

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) - Possbily Nasty

edifier · 11-11-2006, 10:28 PM

Quote:

Originally Posted by computermaineack

Here's a few problems:

O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe - Virus

O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" - Possibly a Trojan

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) - Possibly Nasty

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) - Possbily Nasty

Try again. All LEGIT.

computermaineack · 11-11-2006, 10:33 PM

Quote:

Originally Posted by edifier

Try again. All LEGIT.

Not according to Hijackthis...look over the analysis here: http://hijackthis.de/logfiles/77db63...9950685e2.html

edifier · 11-11-2006, 10:38 PM

Before you start posting from that, learn how to use it first. Beside where it says 'Nasty', click on the gold stars below 'Hit Rate'. As you will see, it is perfectly LEGIT!.

computermaineack · 11-11-2006, 10:41 PM

Quote:

Originally Posted by edifier

Before you start posting from that, learn how to use it first. Beside where it says 'Nasty', click on the gold stars below 'Hit Rate'. As you will see, it is perfectly LEGIT!.

Yeah...if you have an HP/Compaq computer, which the OP doesn't.

edifier · 11-11-2006, 11:22 PM

Description : Subscription reminder to unlock unlimited use for SoftThinks CD "Creator" CD/DVD rewriting software, "usually" supplied with HP PC's as a pre-installed package.

And the poster does have quite abit of 'HP Software' installed don't they?.

spkenn5 · 11-13-2006, 05:22 PM

okay, restarted.. still stuck at the windows xp loading screen for 5+ mins =\

11-11-2006, 08:01 PM	#12 (permalink)
spkenn5 Silver Member Join Date: Jan 2006 Location: Philadelphia,PA Age: 19 Posts: 191	symantec core LC is critical, couldnt be erased. should i restart now? __________________ Intel Pentium 4 3.0ghz MSI Dekstop Board Nvidia Geforce FX5200 128 Mb (NEED TO CHANGE) 1.5G Of RAM unknown 4 fans ^_^ 1 x Maxtor IDE 160GB :) NEW :) Aspire 350W Power supply eMachine 17' Monitor(NEED TO CHANGE) Windows XP Home Edition SP2

11-11-2006, 10:20 PM	#14 (permalink)
computermaineack Diamond Member Join Date: Dec 2004 Location: Connecticut Posts: 2,260	Here's a few problems: O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe - Virus O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" - Possibly a Trojan O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) - Possibly Nasty O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) - Possbily Nasty __________________ "Former Clinton advisor Dick Morris said, "Hillary Clinton will be the next President, but she'll be the worst President we've ever seen." After hearing this, President Bush said, "Wait a minute, I'm not finished yet."" -Conan O'Brien CPU: Q6600 G0 Mobo: eVGA 680i NF67-A1 Case: Antec P180B GPU: eVGA 8800GTS G92 512mb HSF: Tuniq Tower 120 RAM: 4gb DDR2-800 Corsair XMS2 4-4-4-12 PSU: Antec True Power Trio 550w

11-13-2006, 05:22 PM	#20 (permalink)
spkenn5 Silver Member Join Date: Jan 2006 Location: Philadelphia,PA Age: 19 Posts: 191	okay, restarted.. still stuck at the windows xp loading screen for 5+ mins =\ __________________ Intel Pentium 4 3.0ghz MSI Dekstop Board Nvidia Geforce FX5200 128 Mb (NEED TO CHANGE) 1.5G Of RAM unknown 4 fans ^_^ 1 x Maxtor IDE 160GB :) NEW :) Aspire 350W Power supply eMachine 17' Monitor(NEED TO CHANGE) Windows XP Home Edition SP2

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
!Urgent!:: Application Hijack & Hijackthis log	Kilee	Computer Security	3	10-22-2005 08:44 PM
Hijack log help please	vaiolator	Computer Security	4	10-03-2005 10:30 PM
Hijack this Log	Foel	Computer Security	5	08-14-2005 09:37 AM
used mcfee, spybot, adware, etc. POPUP PERSISTS! HELP! Hijack log is here	genedna	Computer Security	6	08-06-2005 01:28 PM
Toshiba Hijack this log	ANNR	Computer Security	5	07-28-2005 06:05 PM

11-11-2006, 07:44 PM	#11 (permalink)
edifier Platinum Member Join Date: Jan 2006 Posts: 567	Even though you uninstalled Norton, there are still 2 Norton services running. Lets get rid of those and some other unnecessary startup items.Do the following. If you can access the below manually, take it out, if not, leave it. Run HijackThis and put a check by the following entries, close all open windows and browsers except HijackThis and click 'Fix Checked' R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY... on&pf=laptop R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TY... on&pf=lapto O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe" O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe O4 - HKLM\..\Run: [Reminder] C:\Windows\CREATOR\Remind_XP.exe O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background You might have to go into your messengers and select disable at startup. O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\Go ogleToolbarNotifier.exe" O4 - HKCU\..\Run: [Steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavili on&pf=laptop Exit 'HJT'. On your desktop, click 'start/run' and type in services.msc and click okay. Look for both of these entries. Automatic LiveUpdate Scheduler or ALUSchedulerSvc.exe Symantec Core LC or symlcsvc.exe Select Stop/apply and okay. Open HijackThis and select - Misc. Tools/Delete an NT Service Type in one at a time -Automatic LiveUpdate Scheduler and Symantec Core LC - make sure the spelling is EXACT. Don't reboot until both have been entered. Now let's see if it starts up quicker now.

11-11-2006, 10:12 PM	#13 (permalink)
edifier Platinum Member Join Date: Jan 2006 Posts: 567	Okay, try restarting.

11-11-2006, 10:38 PM	#17 (permalink)
edifier Platinum Member Join Date: Jan 2006 Posts: 567	Before you start posting from that, learn how to use it first. Beside where it says 'Nasty', click on the gold stars below 'Hit Rate'. As you will see, it is perfectly LEGIT!.

11-11-2006, 11:22 PM	#19 (permalink)
edifier Platinum Member Join Date: Jan 2006 Posts: 567	Description : Subscription reminder to unlock unlimited use for SoftThinks CD "Creator" CD/DVD rewriting software, "usually" supplied with HP PC's as a pre-installed package. And the poster does have quite abit of 'HP Software' installed don't they?.