system
April 12, 2006, 11:46am
1
Hello. I posted a malware issue last week and I think I got it taken care of. But during all of this I ran a Hijack This log and someone noticed some entries that had “files missing” that were suggested to be removed. A couple of these entries were Avast related. Would someone here be willing to take a look at my log to see what they think? I am intimidated by Hijack This and/or the registry. Avast seems to be running just fine. The processes are running, email is scanning, web is scanning, etc.
PK
Running processes:
continued on next post
system
April 12, 2006, 11:46am
2
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/?page=1&refresh=2 http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/c381/chat.cab http://housecall60.trendmicro.com/housecall/xscan60.cab http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab http://musicstore.connect.com/assets/activexplayer/SMALStreaming.cab http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab http://mediaplayer.walmart.com/installer/install.cab http://transfers.one.microsoft.com/FTM/TransferSource/grTransferCtrl.cab http://echat.us.dell.com/Media/VisitorChat/TLIEFlash.CAB http://www.trendmicro.com/spyware-scan/as4web.cab http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab http://pccheckup.dellfix.com/rel/35/install/gtdownde.cab http://driveragent.com/files/driveragent.cab http://entimg.msn.com/client/msnmusax3112.cab http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4734/mcfscan.cab http://chat.msn.com/controls/msnchat45.cab http://www.trueswitch.com/sbc/TrueInstallSBC.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
system
April 12, 2006, 11:57am
3
Hi and welcomehttp://hijackthis.de/
Your Hijackthis log file looks pretty good to me
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) =Microsoft Money- NOT harmful. Do you use this?
Do you know what these two are?http://mediaplayer.walmart.com/installer/install.cab_
O16 - DPF: {341FF14B-00CB-49F5-A427-A164DF1D5E1F} (MALPlaybackCtrl Class) - _http://musicstore.connect.com/assets/activexplayer/SMALStreaming.cab_
system
April 12, 2006, 12:16pm
5
I Hijack This flaw? Seriously? phew Is this documented anywhere?
I know there are a couple of entries that should problably delete (like the one you mentioned tednelly and cloussau).
And yeah, I did download those other two. I know what they are. They are fine.
PK
DavidR
April 12, 2006, 1:40pm
6
I don’t think you will find it documented anywhere but it is a known flaw, and is easy to test, look for the missing file on your system and you should find it. Not to mention your Web Shield and Internet mail scanners are both working, which they wouldn’t be if the file/s were missing ?
Ignore any 023 reference to avast processes, this is a hiccup in the HJT 1.99.1 (especially missing file entry for avast), which wasn’t an issue in the previous version of HJT.
Hi Allochtonous,
You can download this, and see what it comes up with:http://www.spywaredata.com/spyware/download.php
polonus
system
April 12, 2006, 5:08pm
8
So how is your "beta" Windows Defender treating you ?
Have heard of update problems with this program on other
sites . Best NOT to be a guinea pig for "beta" products,
even if it is Microsoft .
Why don't you have a trustworthy antiSPYWARE program,
like Ad-Aware from Lavasoft ? This program is best
downloaded from :
www.majorgeeks.com/download506.html .
And to "complement" your antivirus & antispyware
programs, should have Ewido from www.ewido.net/en .
This program "specializes" in detecting & removing trojans,
worms, & generic dialers that the others are not as good.
system
April 12, 2006, 10:57pm
9
I do use Ad Aware, but the free version does not do active protection. That is why i use Defender. It’s free AND active.
I have only had Defender for about a week now, but have been using MS Antispy since about as long as it has been out. I haven’t had too many probs with it. I had a minor issue last summer, but i can’t even recall exactly what it was.
I actually liked the old interface better than Defender.
I sure am glad I asked about HJT before i followed that other person’s advice. He meant well, but just was unfamiliar with the Avast specific flaw, apparently.
I DO have too much stuff running. You know how it is with programs hooking to startup automatically. I haven’t had time to go in and weed them out lately.
PK
system
April 13, 2006, 5:18am
10
A good Guide on necessary “Services” is located at :www.tweakhound.com/xp/xptweaks/supertweaks6.htm .
EDIT : I missed I had NOT put a “.” between the “hound”
system
April 13, 2006, 5:07pm
12
The link is working fine since Spiritsongs above edit.
Hi Allochthonous :