Forum Index
Home Forum Radio Memberlist Help Search Quick Links

It appears you have not yet registered with our community which limits what you can do & see. It's Free To register, please click here.



Forum Index » Internet » Spyware / Virus Removal » security leak??
Register Calendar Gallery Mark Forums Read

Spyware / Virus Removal Spyware, virus, browser hijack and other malware removal.

Reply
Page 1 of 2 1 2 >
 
Thread Tools Display Modes
  #1  
Old 10-16-2004, 06:28 AM
roeo727 roeo727 is offline
Junior Member
  
Join Date: Oct 2004
Posts: 11
Send a message via Yahoo to roeo727
security leak??
I have attached a log and would like you to look at it. I can't seem to stay 'clean' and was wondering if I need to check different things in my Internet options Security or Advanced tabs. Last night my son was on the computer and when we ran Ad-Adware SE...149 things came up and the computer wouldn't fix them. It just kind of froze on fixing selection. I'll try it again this afternoon, but in the meantime if you could look at this log and let me know what you think, I would sincerely appreciate it.

Logfile of HijackThis v1.98.2
Scan saved at 7:29:02 AM, on 10/16/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSYSTEMKERNEL32.DLL
C:WINDOWSSYSTEMMSGSRV32.EXE
C:WINDOWSSYSTEMMPREXE.EXE
C:WINDOWSSYSTEMmmtask.tsk
C:PROGRAM FILESCOMMON FILESSYMANTEC SHAREDSYMTRAY.EXE
C:WINDOW***PLORER.EXE
C:WINDOWSTASKMON.EXE
C:WINDOWSSYSTEMSYSTRAY.EXE
C:PROGRAM FILESVERIZON ONLINEWINPOETWINPPPOVERETHERNET.EXE
C:WINDOWSSYSTEMUSBMONIT.EXE
C:PROGRAM FILESNORTON SYSTEMWORKSNORTON ANTIVIRUSNAVAPW32.EXE
C:PROGRAM FILESNORTON SYSTEMWORKSNORTON UTILITIESNPROTECT.EXE
C:WINDOWSSYSTEMATIPTAXX.EXE
C:PROGRAM FILESWIN COMMWINCOMM.EXE
C:PROGRAM FILESWEB_REBATESWEBREBATES0.EXE
C:PROGRAM FILESWIN COMMWINLOCK.EXE
C:WINDOWSSYSTEMOAEIXA.EXE
C:PROGRAM FILESNORTON SYSTEMWORKSNORTON CLEANSWEEPCSINSM32.EXE
C:Program FilesNorton SystemWorksNorton CleanSweepMonwow.exe
C:WINDOWSSYSTEMWMIEXE.EXE
C:PROGRAM FILESWEB_REBATESWEBREBATES1.EXE
C:MY DOCUMENTSROE'S DOCSHIGHJACK THISHIJACKTHIS.EXE
C:PROGRAM FILESINTERNET EXPLORERIEXPLORE.EXE

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://red.clientapps.yahoo.com/customize/...rch/search.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Page = http://www.microsoft.com/isapi/redir.dll?p...=ie&ar=iesearch
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.yahoo.com/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?p...er=6&ar=msnhome
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?p...=ie&ar=iesearch
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://red.clientapps.yahoo.com/customize/...rch/search.html
R0 - HKLMSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.microsoft.com/isapi/redir.dll?p...B_PVER}&ar=home
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = localhost
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:Program FilesNorton SystemWorksNorton AntiVirusNavShExt.dll
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:WINDOWS2_0_1browserhelper2.dll
O2 - BHO: BHObj Class - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - C:WINDOWSNEM219.DLL
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:WINDOWSSYSTEMMSBE.DLL
O2 - BHO: (no name) - {00320615-B6C2-40A6-8F99-F1C52D674FAD} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSYSTEMMSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:Program FilesNorton SystemWorksNorton AntiVirusNavShExt.dll
O4 - HKLM..Run: [ScanRegistry] C:WINDOWSscanregw.exe /autorun
O4 - HKLM..Run: [TaskMonitor] C:WINDOWStaskmon.exe
O4 - HKLM..Run: [SystemTray] SysTray.Exe
O4 - HKLM..Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM..Run: [a-winpoet-service] "C:Program FilesVerizon OnlineWinPoETwinpppoverethernet.exe"
O4 - HKLM..Run: [Gene USB Monitor] C:WINDOWSSYSTEMUSBMonit.exe
O4 - HKLM..Run: [NAV Agent] C:PROGRA~1NORTON~2NORTON~1NAVAPW32.EXE
O4 - HKLM..Run: [NPROTECT] C:Program FilesNorton SystemWorksNorton UtilitiesNPROTECT.EXE
O4 - HKLM..Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM..Run: [QuickTime Task] "C:WINDOWSSYSTEMQTTASK.EXE" -atboottime
O4 - HKLM..Run: [Symantec NetDriver Monitor] C:PROGRA~1SYMNET~1SNDMON.EXE
O4 - HKLM..Run: [Win Comm] C:PROGRAM FILESWIN COMMWINCOMM.EXE
O4 - HKLM..Run: [WebRebates0] "C:PROGRAM FILESWEB_REBATESWebRebates0.exe"
O4 - HKLM..Run: [rhfmvbfpbh] C:WINDOWSSYSTEMoaeixa.exe
O4 - HKLM..RunServices: [ScriptBlocking] "C:Program FilesCommon FilesSymantec SharedScript BlockingSBServ.exe" -reg
O4 - HKLM..RunServices: [SymTray - Norton SystemWorks] C:Program FilesCommon FilesSymantec SharedSymTray.exe "Norton SystemWorks"
O4 - HKLM..RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - Startup: CleanSweep Smart Sweep-Internet Sweep.lnk = C:Program FilesNorton SystemWorksNorton CleanSweepcsinsm32.exe
O4 - Global Startup: Verizon Online.lnk = C:Program FilesVerizon OnlineVOLSWVerizon Online.exe
O8 - Extra context menu item: Web Rebates - file://C:PROGRAM FILESWEB_REBATESSy1150Tp1150scri1150a.htm
O9 - Extra button: Control Pad - {28D44DAC-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:PROGRAM FILESVERIZON ONLINECONTROLPADMisca_menu.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:PROGRAM FILESAIM95AIM.EXE
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:WINDOWSwebrelated.htm
O16 - DPF: Yahoo! Gin - http://download.games.yahoo.com/games/clie...nts/y/nt1_x.cab
O16 - DPF: Yahoo! Canasta - http://download.games.yahoo.com/games/clie...nts/y/yt1_x.cab
O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clie...ts/y/dot2_x.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha...t/c381/chat.cab
O16 - DPF: Yahoo! Freecell Solitaire - http://yog55.games.scd.yahoo.com/yog/y/fs10_x.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSCo...ol_v1-0-3-0.cab
O16 - DPF: Backgammon by pogo - http://gammon.pogo.com/applet-5.8.3.20/bac...n-ob-assets.cab
O16 - DPF: Yahoo! Backgammon - http://download.games.yahoo.com/games/clie...nts/y/at1_x.cab

Thank you....
Rosemary
Reply With Quote
Posted


  #2  
Old 10-16-2004, 06:38 AM
Don77 Don77 is offline
Trusted Advisor
  
Join Date: Sep 2004
Location: Boston Ma.
Posts: 27
Send a message via AIM to Don77 Send a message via Yahoo to Don77
Hi Rosemary.
Try running, Ad-aware in safe mode, Be sure and check it for updates prior to booting to safe mode, After you have run it in safe mode and had it fix everything it finds, Run it again in normal mode,
Run Spybot as well, again check for updates prior to running,

Then post back a fresh HJT log please, There are a few things to fix, But please run Ad-aware and Spybot first
Reply With Quote
  #3  
Old 10-16-2004, 07:31 AM
Mobo's Avatar
Mobo Mobo is offline
Thinking outside the box
  
Join Date: Sep 2004
Location: Cape Breton
Posts: 4,575
Send a message via ICQ to Mobo Send a message via AIM to Mobo Send a message via MSN to Mobo Send a message via Yahoo to Mobo Send a message via Skype™ to Mobo
Good Morning roe & Don.
Roe, I'm certain don will have you all fixed up but just incase you aren't sure on safe mode read here: http://www.dotcomsecurity.org/forum/viewtopic.php?t=17

Also this will help dramatically http://dotcomsecurity.org/forum/viewtopic.php?t=29
Reply With Quote
  #4  
Old 10-16-2004, 12:40 PM
roeo727 roeo727 is offline
Junior Member
  
Join Date: Oct 2004
Posts: 11
Send a message via Yahoo to roeo727
Another log
Ok guys....I ran both Ad-Adware SE in safe and normal modes and removed everything. I ran Spybot in both safe and normal modes and nothing came up in either. Here is a new log. Let me know what you think. Thanks.....
P.S. Mobo...thank you for that link for the security settings, that is my next project.

Logfile of HijackThis v1.98.2
Scan saved at 1:38:16 PM, on 10/16/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSYSTEMKERNEL32.DLL
C:WINDOWSSYSTEMMSGSRV32.EXE
C:WINDOWSSYSTEMMPREXE.EXE
C:PROGRAM FILESCOMMON FILESSYMANTEC SHAREDSYMTRAY.EXE
C:WINDOWSSYSTEMmmtask.tsk
C:WINDOW***PLORER.EXE
C:WINDOWSTASKMON.EXE
C:WINDOWSSYSTEMSYSTRAY.EXE
C:PROGRAM FILESVERIZON ONLINEWINPOETWINPPPOVERETHERNET.EXE
C:WINDOWSSYSTEMUSBMONIT.EXE
C:PROGRAM FILESNORTON SYSTEMWORKSNORTON ANTIVIRUSNAVAPW32.EXE
C:PROGRAM FILESNORTON SYSTEMWORKSNORTON UTILITIESNPROTECT.EXE
C:WINDOWSSYSTEMATIPTAXX.EXE
C:PROGRAM FILESWIN COMMWINCOMM.EXE
C:PROGRAM FILESWIN COMMWINLOCK.EXE
C:PROGRAM FILESNORTON SYSTEMWORKSNORTON CLEANSWEEPCSINSM32.EXE
C:Program FilesNorton SystemWorksNorton CleanSweepMonwow.exe
C:WINDOWSSYSTEMWMIEXE.EXE
C:MY DOCUMENTSROE'S DOCSHIGHJACK THISHIJACKTHIS.EXE

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://red.clientapps.yahoo.com/customize/...rch/search.html
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.yahoo.com/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://red.clientapps.yahoo.com/customize/...rch/search.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = localhost
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:Program FilesNorton SystemWorksNorton AntiVirusNavShExt.dll
O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSYSTEMMSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:Program FilesNorton SystemWorksNorton AntiVirusNavShExt.dll
O4 - HKLM..Run: [ScanRegistry] C:WINDOWSscanregw.exe /autorun
O4 - HKLM..Run: [TaskMonitor] C:WINDOWStaskmon.exe
O4 - HKLM..Run: [SystemTray] SysTray.Exe
O4 - HKLM..Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM..Run: [a-winpoet-service] "C:Program FilesVerizon OnlineWinPoETwinpppoverethernet.exe"
O4 - HKLM..Run: [Gene USB Monitor] C:WINDOWSSYSTEMUSBMonit.exe
O4 - HKLM..Run: [NAV Agent] C:PROGRA~1NORTON~2NORTON~1NAVAPW32.EXE
O4 - HKLM..Run: [NPROTECT] C:Program FilesNorton SystemWorksNorton UtilitiesNPROTECT.EXE
O4 - HKLM..Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM..Run: [QuickTime Task] "C:WINDOWSSYSTEMQTTASK.EXE" -atboottime
O4 - HKLM..Run: [Symantec NetDriver Monitor] C:PROGRA~1SYMNET~1SNDMON.EXE
O4 - HKLM..Run: [Win Comm] C:PROGRAM FILESWIN COMMWINCOMM.EXE
O4 - HKLM..RunServices: [ScriptBlocking] "C:Program FilesCommon FilesSymantec SharedScript BlockingSBServ.exe" -reg
O4 - HKLM..RunServices: [SymTray - Norton SystemWorks] C:Program FilesCommon FilesSymantec SharedSymTray.exe "Norton SystemWorks"
O4 - HKLM..RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - Startup: CleanSweep Smart Sweep-Internet Sweep.lnk = C:Program FilesNorton SystemWorksNorton CleanSweepcsinsm32.exe
O4 - Global Startup: Verizon Online.lnk = C:Program FilesVerizon OnlineVOLSWVerizon Online.exe
O9 - Extra button: Control Pad - {28D44DAC-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:PROGRAM FILESVERIZON ONLINECONTROLPADMisca_menu.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:PROGRAM FILESAIM95AIM.EXE
O16 - DPF: Yahoo! Gin - http://download.games.yahoo.com/games/clie...nts/y/nt1_x.cab
O16 - DPF: Yahoo! Canasta - http://download.games.yahoo.com/games/clie...nts/y/yt1_x.cab
O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clie...ts/y/dot2_x.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha...t/c381/chat.cab
O16 - DPF: Yahoo! Freecell Solitaire - http://yog55.games.scd.yahoo.com/yog/y/fs10_x.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSCo...ol_v1-0-3-0.cab
O16 - DPF: Backgammon by pogo - http://gammon.pogo.com/applet-5.8.3.20/bac...n-ob-assets.cab
O16 - DPF: Yahoo! Backgammon - http://download.games.yahoo.com/games/clie...nts/y/at1_x.cab
Reply With Quote
  #5  
Old 10-16-2004, 01:18 PM
Mobo's Avatar
Mobo Mobo is offline
Thinking outside the box
  
Join Date: Sep 2004
Location: Cape Breton
Posts: 4,575
Send a message via ICQ to Mobo Send a message via AIM to Mobo Send a message via MSN to Mobo Send a message via Yahoo to Mobo Send a message via Skype™ to Mobo
Re: Another log
Rescan again and insert a check next to each of the following then close all browser windows and click "fix checked"


R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file)

O4 - HKLM..Run: [Win Comm] C:PROGRAM FILESWIN COMMWINCOMM.EXE


Now reboot into safe mode, open windows explorer, find then delete:
C:PROGRAM FILESWIN COMM


Reboot normally then update Norton and run a full system scan..
Reply With Quote
  #6  
Old 10-16-2004, 02:16 PM
roeo727 roeo727 is offline
Junior Member
  
Join Date: Oct 2004
Posts: 11
Send a message via Yahoo to roeo727
yet another log....
Ok...I did what you said. Norton came up clean. I did notice that there was a wincomm.lgc file in C:WindowsApplog. Should I delete this file also???? Here's another log:

((((Another question on the security pages that I was reading it says to set the first 2 options in ActiveX section (Download signed and unsigned ActiveX controls) to prompt.....mine is set at aenable for signed and disable for unsigned.....should I definitley change them???))))

Logfile of HijackThis v1.98.2
Scan saved at 3:11:34 PM, on 10/16/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:WINDOWSSYSTEMKERNEL32.DLL
C:WINDOWSSYSTEMMSGSRV32.EXE
C:WINDOWSSYSTEMMPREXE.EXE
C:PROGRAM FILESCOMMON FILESSYMANTEC SHAREDSYMTRAY.EXE
C:WINDOWSSYSTEMmmtask.tsk
C:WINDOW***PLORER.EXE
C:WINDOWSTASKMON.EXE
C:WINDOWSSYSTEMSYSTRAY.EXE
C:PROGRAM FILESVERIZON ONLINEWINPOETWINPPPOVERETHERNET.EXE
C:WINDOWSSYSTEMUSBMONIT.EXE
C:PROGRAM FILESNORTON SYSTEMWORKSNORTON ANTIVIRUSNAVAPW32.EXE
C:PROGRAM FILESNORTON SYSTEMWORKSNORTON UTILITIESNPROTECT.EXE
C:WINDOWSSYSTEMATIPTAXX.EXE
C:WINDOWSSYSTEMWMIEXE.EXE
C:PROGRAM FILESNORTON SYSTEMWORKSNORTON CLEANSWEEPCSINSM32.EXE
C:PROGRAM FILESSPYWAREBLASTERSPYWAREGUARDSGMAIN.EXE
C:Program FilesNorton SystemWorksNorton CleanSweepMonwow.exe
C:PROGRAM FILESSPYWAREBLASTERSPYWAREGUARDSGBHP.EXE
C:PROGRAM FILESINTERNET EXPLORERIEXPLORE.EXE
C:MY DOCUMENTSROE'S DOCSHIGHJACK THISHIJACKTHIS.EXE

R1 - HKCUSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://red.clientapps.yahoo.com/customize/...rch/search.html
R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://www.yahoo.com/
R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Search Bar = http://red.clientapps.yahoo.com/customize/...rch/search.html
R1 - HKCUSoftwareMicrosoftInternet ExplorerSearchURL,(Default) = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com
R1 - HKCUSoftwareMicrosoftWindowsCurrentVersionInternet Settings,ProxyOverride = localhost
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:Program FilesNorton SystemWorksNorton AntiVirusNavShExt.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:PROGRAM FILESSPYWAREBLASTERSPYWAREGUARDDLPROTECT.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSYSTEMMSDXM.OCX
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:Program FilesNorton SystemWorksNorton AntiVirusNavShExt.dll
O4 - HKLM..Run: [ScanRegistry] C:WINDOWSscanregw.exe /autorun
O4 - HKLM..Run: [TaskMonitor] C:WINDOWStaskmon.exe
O4 - HKLM..Run: [SystemTray] SysTray.Exe
O4 - HKLM..Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM..Run: [a-winpoet-service] "C:Program FilesVerizon OnlineWinPoETwinpppoverethernet.exe"
O4 - HKLM..Run: [Gene USB Monitor] C:WINDOWSSYSTEMUSBMonit.exe
O4 - HKLM..Run: [NAV Agent] C:PROGRA~1NORTON~2NORTON~1NAVAPW32.EXE
O4 - HKLM..Run: [NPROTECT] C:Program FilesNorton SystemWorksNorton UtilitiesNPROTECT.EXE
O4 - HKLM..Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM..Run: [QuickTime Task] "C:WINDOWSSYSTEMQTTASK.EXE" -atboottime
O4 - HKLM..Run: [Symantec NetDriver Monitor] C:PROGRA~1SYMNET~1SNDMON.EXE
O4 - HKLM..RunServices: [ScriptBlocking] "C:Program FilesCommon FilesSymantec SharedScript BlockingSBServ.exe" -reg
O4 - HKLM..RunServices: [SymTray - Norton SystemWorks] C:Program FilesCommon FilesSymantec SharedSymTray.exe "Norton SystemWorks"
O4 - HKLM..RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - Startup: CleanSweep Smart Sweep-Internet Sweep.lnk = C:Program FilesNorton SystemWorksNorton CleanSweepcsinsm32.exe
O4 - Startup: SpywareGuard.lnk = C:Program FilesSpywareBlasterSpywareGuardsgmain.exe
O4 - Global Startup: Verizon Online.lnk = C:Program FilesVerizon OnlineVOLSWVerizon Online.exe
O9 - Extra button: Control Pad - {28D44DAC-D1FC-4d4f-BB1B-ADF037C8DDBC} - C:PROGRAM FILESVERIZON ONLINECONTROLPADMisca_menu.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:PROGRAM FILESAIM95AIM.EXE
O16 - DPF: Yahoo! Gin - http://download.games.yahoo.com/games/clie...nts/y/nt1_x.cab
O16 - DPF: Yahoo! Canasta - http://download.games.yahoo.com/games/clie...nts/y/yt1_x.cab
O16 - DPF: Yahoo! Dominoes - http://download.games.yahoo.com/games/clie...ts/y/dot2_x.cab
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha...t/c381/chat.cab
O16 - DPF: Yahoo! Freecell Solitaire - http://yog55.games.scd.yahoo.com/yog/y/fs10_x.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSCo...ol_v1-0-3-0.cab
O16 - DPF: Backgammon by pogo - http://gammon.pogo.com/applet-5.8.3.20/bac...n-ob-assets.cab
O16 - DPF: Yahoo! Backgammon - http://download.games.yahoo.com/games/clie...nts/y/at1_x.cab

Thank you for your help.....
Reply With Quote
  #7  
Old 10-16-2004, 02:27 PM
Mobo's Avatar
Mobo Mobo is offline
Thinking outside the box
  
Join Date: Sep 2004
Location: Cape Breton
Posts: 4,575
Send a message via ICQ to Mobo Send a message via AIM to Mobo Send a message via MSN to Mobo Send a message via Yahoo to Mobo Send a message via Skype™ to Mobo
Re: yet another log....
Thats clean now and as for the active x settings..i would set then as per the tutorial. That way they can be used but it wouls require you clicking yes to do so. Your current setup can hamper some programs from ever running ..
Reply With Quote
  #8  
Old 10-16-2004, 02:44 PM
roeo727 roeo727 is offline
Junior Member
  
Join Date: Oct 2004
Posts: 11
Send a message via Yahoo to roeo727
The tutorial meaning the link entitled "Tighten Security Settings"?? Thanks.
Reply With Quote
  #9  
Old 10-16-2004, 02:45 PM
Mobo's Avatar
Mobo Mobo is offline
Thinking outside the box
  
Join Date: Sep 2004
Location: Cape Breton
Posts: 4,575
Send a message via ICQ to Mobo Send a message via AIM to Mobo Send a message via MSN to Mobo Send a message via Yahoo to Mobo Send a message via Skype™ to Mobo
Yes exactly
Reply With Quote
  #10  
Old 10-16-2004, 02:54 PM
roeo727 roeo727 is offline
Junior Member
  
Join Date: Oct 2004
Posts: 11
Send a message via Yahoo to roeo727
Okie dokie...consider it done.....but the one question that wasn't answered from the last posting is about that Wincomm.lgc ....that is located in C:WindowsAPPLOG.....should it be deleted??? I was thinking it was related to the WinComm.exe file...
Reply With Quote
Reply
Page 1 of 2 1 2 >

« Previous Thread | Next Thread »
Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
Security Update For Windows Xp 12 April 2005 LJM Master Security Alerts and vulnerabilities 1 04-12-2005 02:57 PM
Microsoft December security update Mobo News & Announcements 0 12-18-2004 07:30 AM
Ten New Security Holes in Windows XP SP2? Mobo Security Alerts and vulnerabilities 0 11-13-2004 10:16 PM
To secure IE, upgrade to XP southernlady Browsers | Email Software 0 09-24-2004 05:25 PM



All times are GMT -5. The time now is 05:23 PM.

Contact Us - CyberAnswers - Archive - Privacy Statement - Top

Firefox 2