hijackthis

Hi

I was wondering if one of you guys can go over this log and see if there are certain stuff that need to be removed. Also help me out with deleting Steam and Counter Strike completely.

Here's the log:
Logfile of HijackThis v1.99.1
Scan saved at 2:31:00 AM, on 7/20/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AhnLab\Smart Update Utility\AhnSDsv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\FSI\F-Prot\fpavupdm.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\AhnLab\V3\MonSvcNT.exe
C:\Program Files\AhnLab\APC2\Policy Agent\pasvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\SRS Labs\WOWXT and TSXT Driver\SRS_PostInstaller.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\FSI\F-Prot\F-Sched.exe
C:\Program Files\FSI\F-Prot\F-StopW.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\PROGRA~1\CYBERL~1\INSTAN~1\Win2K\IBurn.exe
C:\Program Files\Samsung\DisplayManager\DisplayManager.exe
C:\Program Files\AhnLab\APC2\Policy Agent\patray.exe
C:\Program Files\AhnLab\Smart Update Utility\AhnSD.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AhnLab\V3\V3P3AT.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\AhnLab\V3\V3IMPro.exe
C:\Program Files\SAMSUNG\MagicKBD\PerformanceManager.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\AIM\AIM Pro\aimpro.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [FRISK FP-Scheduler] C:\Program Files\FSI\F-Prot\F-Sched.exe STARTUP
O4 - HKLM\..\Run: [F-StopW] C:\Program Files\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe "
O4 - HKLM\..\Run: [High Definition Audio] HDAShCut.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [MagicKeyboard] C:\Program Files\SAMSUNG\MagicKBD\PreMKBD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe "
O4 - HKLM\..\Run: [B'sCLiP] C:\PROGRA~1\CYBERL~1\INSTAN~1\Win2K\IBurn.exe
O4 - HKLM\..\Run: [DisplayManager] C:\Program Files\Samsung\DisplayManager\DisplayManager.exe
O4 - HKLM\..\Run: [imekrmig7.0] "C:\Program Files\Common Files\Microsoft Shared\IME\IMKR7\IMEKRMIG.EXE "
O4 - HKLM\..\Run: [Inciter Inspector] C:\WINDOWS\InciterInstaller\ICAgent.exe -reboot
O4 - HKLM\..\Run: [PaTray] "C:\Program Files\AhnLab\APC2\Policy Agent\patray.exe "
O4 - HKLM\..\Run: [AHNSD] "C:\Program Files\AhnLab\Smart Update Utility\AhnSD.exe "
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O8 - Extra context menu item: Bluetooth(&B)... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Microsoft Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java ?? - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: ¸®¼*A¡ - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.yahoo.co.kr
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3B56E5F0-7B20-48BF-B439-A995BE5191EF} (SessionControl Control) - http://pib.wooribank.com/com/common/SessionControl.cab
O16 - DPF: {6CE20149-ABE3-462E-A1B4-5B549971AA38} (XecureCKKB Class) - http://pib.wooribank.com/com/XecureCK/CKKeyPro.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1166576271531
O16 - DPF: {7E9FDB80-5316-11D4-B02C-00C04F0CD404} (XecureWeb 4.0 Client Control) - http://pib.wooribank.com/XecureObject/xw_install.cab
O16 - DPF: {EA7F451B-94DD-4009-A8BF-8F977B0B2696} - http://pbells.broadjump.com/wizlet/StandardInstall/static/controls/WebflowActiveXInstaller_4-2-0.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4B5076C8-D9CC-4053-ACA3-C00CF87FF458}: NameServer = 205.152.37.23,205.152.144.23
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AhnLab Task Scheduler - AhnLab, Inc. - C:\Program Files\AhnLab\Smart Update Utility\AhnSDsv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: F-Prot Antivirus Update Monitor - FRISK Software - C:\Program Files\FSI\F-Prot\fpavupdm.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MonSvcNT - AhnLab, Inc. - C:\PROGRA~1\AhnLab\V3\MonSvcNT.exe
O23 - Service: Policy Agent Service V3.0 (paSvc) - AhnLab, Inc. - C:\Program Files\AhnLab\APC2\Policy Agent\pasvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Samsung Update Plus - Unknown owner - C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe
O23 - Service: SRS PostInstaller Service (SRS_PostInstaller) - SRS Labs, Inc. - C:\Program Files\SRS Labs\WOWXT and TSXT Driver\SRS_PostInstaller.exe

 

Hi Spiky Pirate

Don't really see any malware, but there are a few things you can fix.

We need to stop processes on This, Here is how to do this…
Press Ctr> Alt> Delete to bring up Task Manager
Click on the Process Tab.
Click on any of the Processes below (one at a time) and click on End Tasks.

Steam.exe

Please go to Start > Control Panel > Add/Remove Programs and remove the following (if present):

Counter Strike
Steam

Please re-open HiJackThis and scan only. Check the boxes next to all the entries listed below.

O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe

Now close all windows other than HiJackThis, then click Fix Checked.

Close HJT.

Reboot into safe mode.
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Using Windows Explorer (to get there right-click your Start button and go to "Explore "), please delete these folders (if present):

c:\program files\steam
c:\program files\Counter Strike

After that, Reboot.

That should get rid of Counter Strike and Steam.

Geri

 

okay, i tabbed f8 continuaslly as soon as the computer restarted and nothing happened.

 

never mind, i had to hold f8 instead of tapping it.
There were no steam or counter strike folders present.

I guess i got rid of everything relating to steam?
Do u know how to get rid of the registries relating to steam and counter strike

thx

 

Hi

I use this "RegCleaner" and it's pretty simple. This is a old version, The new versions are not free.

http://www.majorgeeks.com/download460.html

Geri

 

do i just scan with that and delete all the steam and counter strike related stuff?

 

Hi
On the software tab, put a check mark next to stream and counter strike and click on remove selected

Geri

 

i'm thinking about removing these following registries. I was wondering if it was safe to remove them, so heres the list:

Author: Gamespy, Software: Gamespy 3D, Age: New
Author: Gearbox, Software: Halflife, Age: New
Author: Valve, Software: Steam, Age: New
Author: Valve, Software: Half-Life, Age: New
Author: Valve, Software: Source, Age:New

This is advanced Info:

RegCleaner 4.3 by Jouni Vuorio

Author : [Unknown]
Software : Maxthon
Age : Old

If you choose to remove this item these keys would be removed
HKEY_CURRENT_USER\Software\GameSpy\GameSpy 3D\Registration
HKEY_CURRENT_USER\Software\GameSpy\GameSpy 3D
HKEY_LOCAL_MACHINE\Software\Gearbox\Halflife
HKEY_LOCAL_MACHINE\Software\Valve\Steam
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\steam
HKEY_CLASSES_ROOT\Valve.Source\shell\open\command
HKEY_CURRENT_USER\Software\Valve\Half-Life\cstrike
HKEY_CURRENT_USER\Software\Valve\Half-Life\czero
HKEY_CURRENT_USER\Software\Valve\Half-Life\czeror
HKEY_CURRENT_USER\Software\Valve\Half-Life\dod
HKEY_CURRENT_USER\Software\Valve\Half-Life\Settings
HKEY_CURRENT_USER\Software\Valve\Half-Life\svencoop
HKEY_CURRENT_USER\Software\Valve\Half-Life\tfc
HKEY_CURRENT_USER\Software\Valve\Half-Life\valve
HKEY_CURRENT_USER\Software\Valve\Half-Life
HKEY_CURRENT_USER\Software\Valve\Source\cstrike
HKEY_CURRENT_USER\Software\Valve\Source\dod
HKEY_CURRENT_USER\Software\Valve\Source\hl2
HKEY_CURRENT_USER\Software\Valve\Source\hl2mp
HKEY_CURRENT_USER\Software\Valve\Source\Settings
HKEY_CURRENT_USER\Software\Valve\Source
HKEY_CURRENT_USER\Software\Maxthon

 

I went over the entire software list and have found some suspicious/useless files.. Take a look at these and tell me whether i should remove them as well.

Author Software Age

Aureal A3D New
B.h.a. B'sCLiP New
C07ft5Y winxp New
Chilkat Software, Inc. ChilkatXmlChilkatXmal New
FullCircle TalkBack New
GemPlus Cryptography New
Netscape Netscape Navigator New
Staccato SCa New
StarSynergy 2 New
WebEx Config New
Xfire Exceptions New
Unknown Licenses Old
Unknown RegisteredApplications Old
Unknown WebEx Old
Unknown IGA Old

Advanced Information:

RegCleaner 4.3 by Jouni Vuorio

Author : Widcomm
Software : BTTray
Age : New

If you choose to remove this item these keys would be removed
HKEY_LOCAL_MACHINE\Software\Aureal\A3d
HKEY_LOCAL_MACHINE\Software\B.h.a\B'sCLiP
HKEY_LOCAL_MACHINE\Software\C07ft5Y\WinXP
HKEY_LOCAL_MACHINE\Software\Chilkat Software, Inc.\ChilkatXml.ChilkatXml
HKEY_LOCAL_MACHINE\Software\FullCircle\TalkBack\MozillaOrgFirefox2Win322006120418
HKEY_LOCAL_MACHINE\Software\FullCircle\TalkBack\MozillaOrgFirefox2Win322007030919
HKEY_LOCAL_MACHINE\Software\FullCircle\TalkBack\MozillaOrgFirefox2Win322007051502
HKEY_LOCAL_MACHINE\Software\FullCircle\TalkBack\MozillaOrgFirefox2Win322007071317
HKEY_LOCAL_MACHINE\Software\FullCircle\TalkBack
HKEY_LOCAL_MACHINE\Software\Gemplus\Cryptography\SmartCards
HKEY_LOCAL_MACHINE\Software\Gemplus\Cryptography
HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Suffixes
HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\User Trusted External Applications
HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\Viewers
HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator
HKEY_LOCAL_MACHINE\Software\Staccato\SCa\CP
HKEY_LOCAL_MACHINE\Software\Staccato\SCa
HKEY_CURRENT_USER\Software\StarSynergy\2\act
HKEY_CURRENT_USER\Software\StarSynergy\2
HKEY_CURRENT_USER\Software\WebEx\Config
HKEY_CURRENT_USER\Software\Widcomm\BTTray
HKEY_CURRENT_USER\Software\Xfire\Exceptions
HKEY_LOCAL_MACHINE\Software\Licenses
HKEY_LOCAL_MACHINE\Software\RegisteredApplications
HKEY_CURRENT_USER\Software\WebEx\Config
HKEY_CURRENT_USER\Software\WebEx
HKEY_LOCAL_MACHINE\Software\WebEx
HKEY_CURRENT_USER\Software\IGA

 

i got rid of these registries:

Author: Gamespy, Software: Gamespy 3D, Age: New
Author: Gearbox, Software: Halflife, Age: New
Author: Valve, Software: Steam, Age: New
Author: Valve, Software: Half-Life, Age: New
Author: Valve, Software: Source, Age:New

and restarted my computer and reinstalled counter strike again.
But something keeps changing all the counter strike settings, and im thinking some kind of program is running

 

Hi Spiky Pirate

First let me caution you when useing any reg cleaner, it is best not to delete anything unless you search what it is that you plan on deleting.

Google everything and read, and then read some more to find out what it is.
Remember ! some virus and malware will use legit file names, so you must be carefull !!

OK, That said.
I would post this problem here,
http://www.steamgames.com/v/index.php?area=forums&cc=US

They would more then likely give you a better idea on what to do then I could, I don't have counter strike so They would be better able to help you out here.

Geri