1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Jeeves

Discussion in 'Security and Privacy' started by Sue, 2004/03/24.

Thread Status:
Not open for further replies.
  1. 2004/03/24
    Sue

    Sue Inactive Thread Starter

    Joined:
    2002/04/12
    Messages:
    284
    Likes Received:
    0
    I have a windows 2000 pro station. If you open network neighborhood or my network places, "just ask jeeves" website opens up.

    I have uninstalled everything possible, ran spybot. no luck.

    Does anyone have any ideas on what this is about.?
     
    Sue,
    #1
  2. 2004/03/24
    Newt

    Newt Inactive

    Joined:
    2002/01/07
    Messages:
    10,974
    Likes Received:
    2
    Sue - you do come across some of the more interesting problems. Fun for us but probably not quite so much for you?

    I've never heard of a hijack of those windows but it certainly does sound like it.

    Download Hijackthis, run it from the winzip window of you want or put it in a more permanent place and then run it from there. Once it finishes, you'll have a screen full of stuff and a new button option to save the log. Do that then post the log here.

    Moving this to security since I think it's more that sort of issue.
     
    Newt,
    #2


  3. to hide this advert.

  4. 2004/03/24
    Sue

    Sue Inactive Thread Starter

    Joined:
    2002/04/12
    Messages:
    284
    Likes Received:
    0
    Thanks. I do have some very interesting days.
     
    Sue,
    #3
  5. 2004/03/25
    Sue

    Sue Inactive Thread Starter

    Joined:
    2002/04/12
    Messages:
    284
    Likes Received:
    0
    This is the log file:

    Logfile of HijackThis v1.97.7
    Scan saved at 8:56:36 AM, on 3/25/2004
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\Altiris\AClient\AClient.exe
    C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\Explorer.EXE
    C:\WINNT\System32\igfxtray.exe
    C:\WINNT\System32\hkcmd.exe
    C:\Program Files\Altiris\AClient\AClntUsr.EXE
    C:\WINNT\system32\iedriver.exe
    C:\WINNT\system32\ctfmon.exe
    C:\WINNT\SCMain.exe
    C:\WINNT\WCMain.exe
    C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE
    C:\Program Files\Network Associates\VirusScan\VsStat.exe
    C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
    C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
    C:\Program Files\Network Associates\VirusScan\Avconsol.exe
    C:\Documents and Settings\norstrudj\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://waldorf-web/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.10.0.1:8080
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {63B78BC1-A711-4D46-AD2F-C581AC420D41} - C:\WINNT\system32\btiein.dll
    O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
    O4 - HKLM\..\Run: [AClntUsr] C:\Program Files\Altiris\AClient\AClntUsr.EXE
    O4 - HKLM\..\Run: [iedriver] C:\WINNT\system32\iedriver.exe
    O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
    O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Stardust Screen Saver Control 2003.lnk = C:\WINNT\SCMain.exe
    O4 - Global Startup: Stardust Wallpaper Control 2003.lnk = C:\WINNT\WCMain.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
    O16 - DPF: Yahoo! Klondike Solitaire - http://yog55.games.scd.yahoo.com/yog/y/ks12_x.cab
    O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt0_x.cab
    O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50038/QDow.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37651.6443287037
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = waldorf.edu
    O17 - HKLM\System\CCS\Services\Tcpip\..\{8991F971-DD2E-44F8-815F-832D54675159}: NameServer = 10.10.0.2
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = waldorf.edu
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = waldorf.edu
     
    Sue,
    #4
  6. 2004/03/25
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    You have adware/malware. Install, immediately update and run both Spybot and Ad-aware. Delete all they find. Reboot. Then post another HJT log.
     
    noahdfear,
    #5
  7. 2004/03/25
    Sue

    Sue Inactive Thread Starter

    Joined:
    2002/04/12
    Messages:
    284
    Likes Received:
    0
    Logfile of HijackThis v1.97.7
    Scan saved at 11:23:39 AM, on 3/25/2004
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\Altiris\AClient\AClient.exe
    C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\system32\svchost.exe
    C:\Program Files\Network Associates\VirusScan\VsStat.exe
    C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
    C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
    C:\Program Files\Network Associates\VirusScan\Avconsol.exe
    C:\WINNT\Explorer.EXE
    C:\WINNT\System32\igfxtray.exe
    C:\WINNT\System32\hkcmd.exe
    C:\Program Files\Altiris\AClient\AClntUsr.EXE
    C:\WINNT\system32\iedriver.exe
    C:\WINNT\system32\ctfmon.exe
    C:\WINNT\SCMain.exe
    C:\WINNT\WCMain.exe
    C:\Documents and Settings\norstrudj\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://waldorf-web/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.10.0.1:8080
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
    O4 - HKLM\..\Run: [AClntUsr] C:\Program Files\Altiris\AClient\AClntUsr.EXE
    O4 - HKLM\..\Run: [iedriver] C:\WINNT\system32\iedriver.exe
    O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
    O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Stardust Screen Saver Control 2003.lnk = C:\WINNT\SCMain.exe
    O4 - Global Startup: Stardust Wallpaper Control 2003.lnk = C:\WINNT\WCMain.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
    O16 - DPF: Yahoo! Klondike Solitaire - http://yog55.games.scd.yahoo.com/yog/y/ks12_x.cab
    O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt0_x.cab
    O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50038/QDow.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37651.6443287037
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = waldorf.edu
    O17 - HKLM\System\CCS\Services\Tcpip\..\{8991F971-DD2E-44F8-815F-832D54675159}: NameServer = 10.10.0.2
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = waldorf.edu
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = waldorf.edu

    Ad-ware found 137. Spybot was clean.
     
    Sue,
    #6
  8. 2004/03/25
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Scan again and check these, then fix.

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
    O4 - HKLM\..\Run: [iedriver] C:\WINNT\system32\iedriver.exe

    See this page.
     
    noahdfear,
    #7
  9. 2004/03/25
    Sue

    Sue Inactive Thread Starter

    Joined:
    2002/04/12
    Messages:
    284
    Likes Received:
    0
    Logfile of HijackThis v1.97.7
    Scan saved at 12:58:46 PM, on 3/25/2004
    Platform: Windows 2000 SP4 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\Altiris\AClient\AClient.exe
    C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\Explorer.EXE
    C:\WINNT\system32\svchost.exe
    C:\Program Files\Network Associates\VirusScan\VsStat.exe
    C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
    C:\WINNT\System32\igfxtray.exe
    C:\WINNT\System32\hkcmd.exe
    C:\Program Files\Altiris\AClient\AClntUsr.EXE
    C:\WINNT\system32\ctfmon.exe
    C:\WINNT\SCMain.exe
    C:\Program Files\Network Associates\VirusScan\Avconsol.exe
    C:\WINNT\WCMain.exe
    C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
    C:\Program Files\ORL\VNC\WinVNC.exe
    C:\Documents and Settings\norstrudj\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://waldorf-web/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 10.10.0.1:8080
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
    O4 - HKLM\..\Run: [AClntUsr] C:\Program Files\Altiris\AClient\AClntUsr.EXE
    O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
    O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Stardust Screen Saver Control 2003.lnk = C:\WINNT\SCMain.exe
    O4 - Global Startup: Stardust Wallpaper Control 2003.lnk = C:\WINNT\WCMain.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab
    O16 - DPF: Yahoo! Klondike Solitaire - http://yog55.games.scd.yahoo.com/yog/y/ks12_x.cab
    O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt0_x.cab
    O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsyndicate.com/Dnl/T_50038/QDow.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37651.6443287037
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = waldorf.edu
    O17 - HKLM\System\CCS\Services\Tcpip\..\{8991F971-DD2E-44F8-815F-832D54675159}: NameServer = 10.10.0.2
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = waldorf.edu
    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = waldorf.edu

    Still did not fix the problem.
     
    Sue,
    #8
  10. 2004/03/25
    Sue

    Sue Inactive Thread Starter

    Joined:
    2002/04/12
    Messages:
    284
    Likes Received:
    0
    Got it. It was called huntbar.

    thanks for all the help. I really appreciate it.

    Sue
     
    Sue,
    #9
  11. 2004/03/25
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Great! Log looks good. :)
     
    noahdfear,
    #10
  12. 2004/03/25
    Newt

    Newt Inactive

    Joined:
    2002/01/07
    Messages:
    10,974
    Likes Received:
    2
    Newt,
    #11
  13. 2004/03/25
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Gotta do something at lunch and breaktime. :D
     
    noahdfear,
    #12
  14. 2004/03/26
    Sue

    Sue Inactive Thread Starter

    Joined:
    2002/04/12
    Messages:
    284
    Likes Received:
    0
    Yes, it is a business machine. We are having a huge debate on whether or not employees should be lock down on permissions. I want the users as "power users" and no more, but I don't think I am going to win this one. Oh well, I get paid the same no matter what I do all day.

    Spy bot did not catch huntbar the first time because the upgrade of the versions failed. I didn't notice it right away. I ran the upgrade again and it caught it.

    Thanks for everyones help.
     
    Sue,
    #13
  15. 2004/03/26
    Lonny Jones

    Lonny Jones Inactive Alumni

    Joined:
    2002/12/16
    Messages:
    2,252
    Likes Received:
    0
    "spykiller.exe "
    Shareware "Spyware remover" of questionable quality and repute. There are better alternatives that are freeware to boot.

    Fix this
    O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup

    Then reboot and promptly uninstall the program,, loaded with false possitives that could couse your PC harm
     
    Lonny Jones,
    #14
  16. 2004/03/26
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Noted for future reference Lonny. Thanks! :)
     
    noahdfear,
    #15
  17. 2004/03/26
    Sue

    Sue Inactive Thread Starter

    Joined:
    2002/04/12
    Messages:
    284
    Likes Received:
    0
    I have ran spybot on a number of desktops and all come up with "Alexa ". Does anyone know what that is?

    Thanks
     
    Sue,
    #16
  18. 2004/03/26
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Sue,

    Check out the Help > Index section of Spybot for an explanation of Alexa.
     
    PeteC,
    #17
  19. 2004/03/28
    Johanna

    Johanna Inactive Alumni

    Joined:
    2003/03/08
    Messages:
    2,402
    Likes Received:
    2
    LOL...Alexa is installed by default every time with XP. Sneaky sneaky! Here is what they say about their privacy policy directly:
    http://pages.alexa.com/help/terms.html

    Johanna
    wondering how much money is exchanged between Alexa/Amazon & MS....
     
    Johanna,
    #18
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...