FUNKID7's HJT LOG HERE!

by funkid7 | February 13, 2005 9:01 AM PST

Logfile of HijackThis v1.99.0
Scan saved at 7:47:14 PM, on 2/13/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\tbctray.exe
C:\HJT Folder\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar.dll (file missing)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SAHAgent] C:\WINDOWS\System32\SahAgent.exe
O4 - HKLM\..\Run: [CMESys] "C:\Program Files\Common Files\CMEII\CMESys.exe"
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [TraySantaCruz] C:\WINDOWS\system32\tbctray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1093390638937
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Look at each spy on the list:
SAHagent/CMEsys/New.net start-up
NONE ARE FUNCTIONAL.
Notice:they are in section 04. they do NOT start there proceesses however. Look at my running processes.
They arent slowing me down or crashing programs.
They aren't sending me spam, because I get very little spam and recognize where I got it from.

Discussion is locked

Reply to: FUNKID7's HJT LOG HERE!

PLEASE NOTE: Do not post advertisements, offensive materials, profanity, or personal attacks. Please remember to be considerate of other members. If you are new to the CNET Forums, please read our CNET Forums FAQ. All submitted content is subject to our Terms of Use.

Title Body

Reporting: FUNKID7's HJT LOG HERE!

This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.

Sorry, there was a problem flagging this post. Please try again now or at a later time.

- Collapse -

(NT) (NT) Do you have a question?

by sp_100 | February 13, 2005 9:28 AM PST

- Collapse -

(NT) (NT) No, just requested post by so many.

by funkid7 | February 13, 2005 2:32 PM PST

- Collapse -

Oh! Here's my log then .. :)

by sp_100 | February 13, 2005 4:09 PM PST

.
.
.
------------------------------------------------------
Logfile of HijackThis v1.99.0
Scan saved at 1:23:43 AM, on 2/8/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Documents and Settings\user\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/old
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O23 - Service: Symantec AntiVirus Client - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
------------------------------------------------------
.
.
.

- Collapse -

SLEEK and CLEAN!

by funkid7 | February 14, 2005 4:08 AM PST

Very nice log! Everything in it appears legit.

- Collapse -

Funkid, just FYI

by MarkFlax Forum moderator | February 13, 2005 5:57 PM PST

Copy and paste your log, (all of it), into the automatic HJT log file analyser here; http://www.hijackthis.de/index.php

See what results you get below the Analyze button.

You say "none (spies) are functional", but the analyser gives a different perspective.

Mark

- Collapse -

Okay, I did it. LOOK

by funkid7 | February 14, 2005 5:22 AM PST

I did exactly as you said Mark. It confirmed what I said.
SAHagent is there, but does nothing!
It couldn't even recognize NewDot spy. All I got was a question mark.
CME the same. It tells me what it is, but it does NOT function.
Everything else passed as safe or my choice to have it.

I am correct:
Yahoo Toolbar with IE 6.0 and SP2 is safe for surfing and I am spy free. Yahoo's Anti-spy, on first run found Gator and Coolwebsearch, just to name a couple. IT stopped them, but they still appear in the log.
I know it stopped them, because the problems went away.
I do NOT get spam from them. I have great speed and performance. So why does it matter, the 3 issues I do have cause me NO ILL effects.

- Collapse -

Also about pop-ups...

by funkid7 | February 14, 2005 5:27 AM PST

I haven't seen one in several months. What do pop-ups look like? I forget.

- Collapse -

Correct ?

by Papa Echo | February 14, 2005 5:52 AM PST

OK. Your posts made it look like you used no anti virus, no anti spyware, no anti adware, no anti anything. But you have the Yahoo! Toolbar. It works for you. Others have other tools. So what ?

- Collapse -

Mine is faster and less space.

by funkid7 | February 14, 2005 8:45 AM PST

Mine has it all in one app. So I don't need all the other extra utilities. Yahoo is: your connection, your security and your e-mail all in one package.
Forget Spybot, Adware, Spy Blaster. They all just want you to buy their full version. That is why they do NOT work very well.

- Collapse -

Finally !

by Papa Echo | February 14, 2005 9:18 AM PST

Your choice. Let others have theirs. With today's processors and affordable large HD, a wee bit of speed increase makes no difference for us normal users. No problems with space either.

FUNKID7's HJT LOG HERE!

CNET Forums

Other Forums

Forum Info