OOOOPpps
OK my bad. Got to thinking had older versions of HJT, and a few old logs in the file.Nuked entire HJT folder, started anew with new downloads from your most recent links, and now both the HJT and the analyzer have same version # of 1.98.2, hoping this is the correct version now.
Sending on both the actual log file, and the analyzed file.
Logfile of HijackThis v1.98.2
Scan saved at 2:46:19 PM, on 12/15/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\DIRECPC\webpkg\dpcproxy.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\GEARSec.exe
C:\WINNT\system32\regsvc.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\pctspk.exe
C:\WINNT\system32\WDBtnMgr.exe
C:\Program Files\WDC\SetIcon.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\DirecPC\BIN\dpcstart.exe
C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
C:\Program Files\DirecPC\BIN\dpcnav.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [SetIcon] \Program Files\WDC\SetIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - Global Startup: dpcstart.lnk = C:\Program Files\DirecPC\BIN\dpcstart.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{71431592-C427-460D-8373-64DE7AD99FBA}: Domain = ****************
O17 - HKLM\System\CCS\Services\Tcpip\..\{71431592-C427-460D-8373-64DE7AD99FBA}: NameServer = *****************
Log was analyzed using HijackThis Analyzer - Updated on 12/6/04
Get updates at
http://www.greyknight17.com/download.htm#programs
Logfile of HijackThis v1.98.2
Scan saved at 2:46:19 PM, on 12/15/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\DIRECPC\webpkg\dpcproxy.exe
C:\WINNT\System32\GEARSec.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\system32\WDBtnMgr.exe
C:\Program Files\WDC\SetIcon.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\DirecPC\BIN\dpcstart.exe
C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
C:\Program Files\DirecPC\BIN\dpcnav.exe
C:\HJT\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.yahoo.com/
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [SetIcon] \Program Files\WDC\SetIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - Global Startup: dpcstart.lnk = C:\Program Files\DirecPC\BIN\dpcstart.exe
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zapro.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{71431592-C427-460D-8373-64DE7AD99FBA}: Domain = *********
O17 - HKLM\System\CCS\Services\Tcpip\..\{71431592-C427-460D-8373-64DE7AD99FBA}: NameServer = **************
End of HijackThis Analyzer Log.
Ok another new twist as of today. I have 3 browsers on this system IE6, Firefox, and Opera free version. When I started writing this thread none of the browsers was having a problem keeping a secure connection to my yahoo e-mail, as noted sometimes it would become unsecure, but mostly they worked ok. Then all 3 went belly up for 2 days, wasn`t able to maintain a secure link, would start to load with the little lock closed, but right at the end of the page loading, the lock would pop open. This was consistent with all 3 browsers.
Today IE6 maintains what appears to be a locked "secure" sign on. Firefox keeps the lock closed but now has a red strike (a line) going through the lock (I don`t remeber seeing this in the past, and would assume like a traffic sign this is stating unsecure, but looking at the security cert for this page it says is operational?). Opera starts and ends with the lock hasp open. With all 3 this is an attempt to use secure sign on for my Yahoo e-mail only. I haven`t noted any other pages that are seeming to have a problem, but a few places I go to including here DO NOT offer a secure password entry prior to putting in my password, so I don`t know if I`m comprimised there as well? This thing, whatever it is is getting weird.
I`ve had a bunch of systems down doing upgrades, etc etc. At present only have this 1 online. Will be soon switching out systems for general surfing so in a sense will leave this behind, as my plan is to nuke it clean, but I have several files I`ve downloaded and am having a quandry about what to do with them. I had planned to keep them all, a mix of music MP3`s, some vid files MPEG, AVI, etc, and a few program files. None appeared dastardly, all ran as expected, no EXE files or the like, and all of them go through all the scans I`ve used for bugs, viruses, etc. But I`ve never seen a problem like I`m currently having so I`m thinking one of these files at least has some crapola on it. Thinking again (ouch makes my head hurt) that if it was simply a Winblows problem it wouldn`t be jumping around like this, think I have a bug in my soup.
Any thoughts appreciated. Current plan is to burn all files to CD, keep them around, and hopefully if this is a new type bug maybe a fix will pop up. At least if it is a bug something will point at the darn thing.
g.w.
