Forum     

Go Back   Digit Technology Discussion Forum > Portables, Peripherals and Electronics > QnA (read only)
Am I hijacked? Am I hijacked?
Register FAQ Calendar Mark Forums Read

QnA (read only) Mods please help transfer the contents of this forum to proper sections. :)


 
 
LinkBack Thread Tools Search this Thread Display Modes
Old 07-04-2005, 10:25 PM   #1 (permalink)
Another Brick in the Wall
 
drgrudge's Avatar
 
Join Date: Jul 2004
Location: Dubai/Chennai
Posts: 3,027
Default Am I hijacked?

Hmmm, some useless programs (which i dint know) was starting when i start in my computer, so i thought i would give a shot to hijackthis

==============

Logfile of HijackThis v1.99.1
Scan saved at 9:21:27 PM, on 4/3/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\temp\salm.exe
C:\WINDOWS\dot.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HijackThis.exe

O2 - BHO: Search Relevancy - {1D7E3B41-23CE-469B-BE1B-A64B877923E1} - C:\PROGRA~1\SEARCH~1\SEARCH~1.DLL
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\system32\mscb.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Tsl] C:\PROGRA~1\COMMON~1\tsa\tsl.exe
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [dot] C:\WINDOWS\dot.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O8 - Extra context menu item: Download using Download &Express - C:\Program Files\Download Express\Add_Url.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)


So i interpreted it and see if it holds good.
__________________
I Love Photography. I Love Aperture. I Love Mac.
drgrudge is offline  
Advertisements. Register and be a member of the community to get rid of them.
Advertisement

Old 07-04-2005, 10:26 PM   #2 (permalink)
Another Brick in the Wall
 
drgrudge's Avatar
 
Join Date: Jul 2004
Location: Dubai/Chennai
Posts: 3,027
Default
Quote:
Originally Posted by drgrudge
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\temp\salm.exe
C:\WINDOWS\dot.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HijackThis.exe

O2 - BHO: Search Relevancy - {1D7E3B41-23CE-469B-BE1B-A64B877923E1} - C:\PROGRA~1\SEARCH~1\SEARCH~1.DLL
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\system32\mscb.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Tsl] C:\PROGRA~1\COMMON~1\tsa\tsl.exe
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [dot] C:\WINDOWS\dot.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O8 - Extra context menu item: Download using Download &Express - C:\Program Files\Download Express\Add_Url.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

Ok, shall i remove the red entries?

wht abt the blue ones? (esp. 04 entry od dot.exe)

And i have no idea of 09 entries... , wht to do with so much buttons on main Internet Explorer toolbar?
__________________
I Love Photography. I Love Aperture. I Love Mac.
drgrudge is offline  
Old 07-04-2005, 10:29 PM   #3 (permalink)
why need title?
 
bharathbala2003's Avatar
 
Join Date: Feb 2005
Location: CONFUSED!! AM LOST
Posts: 1,134
Default
u can remove the red ones.. and as far as the blue..

first is power dvd loadin on start up.. then one is real player auto update u can safely remove em.. i dunno about the excel..

as for others i suppose u can keep em.. no harm

(not sure much about the .dot)
bharathbala2003 is offline  
Old 07-04-2005, 11:08 PM   #4 (permalink)
Another Brick in the Wall
 
drgrudge's Avatar
 
Join Date: Jul 2004
Location: Dubai/Chennai
Posts: 3,027
Default
Quote:
Originally Posted by bharathbala2003
u can remove the red ones.. and as far as the blue..

first is power dvd loadin on start up.. then one is real player auto update u can safely remove em.. i dunno about the excel..

as for others i suppose u can keep em.. no harm

(not sure much about the .dot)
Hmm...
powerdvd thing is for remote control ur DVD playback, i case u have one , which i dont have...

realsched.exe is realmedia auto update for real player, also there is a worm by the name LOVE, so i dint know abt it.

i need to know abt dot.exe. and 09 entries, there are so many of them and all of them yahoo
__________________
I Love Photography. I Love Aperture. I Love Mac.
drgrudge is offline  
Old 07-04-2005, 11:16 PM   #5 (permalink)
Human Spambot
 
swatkat's Avatar
 
Join Date: Mar 2004
Location: India
Posts: 2,033
Default
Those 09 entries are the Toolbars, Contect Menu and Tools Menu items in IE, that are added by the Third Party softwares like Yahoo messesnger, Downloaders etc.
You can remove them if you dont want them.
But in your log file, some Yahoo files are missing, so it's better to remove these entries.
Quote:
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
And the 08 entry you highlighted in Blue is the MS Office context menu entry in IE. You can leave it as it is.

And for dot.exe, you can upload it here for a scan.
http://www.kaspersky.com/scanforvirus
__________________
http://swatrant.blogspot.com/
swatkat is offline  
Old 07-04-2005, 11:32 PM   #6 (permalink)
Another Brick in the Wall
 
drgrudge's Avatar
 
Join Date: Jul 2004
Location: Dubai/Chennai
Posts: 3,027
Default
ok, did as said....

Here is the new one.

Logfile of HijackThis v1.99.1
Scan saved at 5:50:53 AM, on 4/4/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\foobar2000\foobar2000.exe
C:\Program Files\Yahoo!\Messenger\YPager.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis.exe

O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [dot] C:\WINDOWS\dot.exe
O8 - Extra context menu item: Download using Download &Express - C:\Program Files\Download Express\Add_Url.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\YAHOO!\MESSEN~1\YPAGER.EXE
O17 - HKLM\System\CCS\Services\Tcpip\..\{52407194-A84A-4255-8CF9-7A24824E3EF0}: NameServer = 61.1.96.69 61.1.96.71




Quote:
O17 - HKLM\System\CCS\Services\Tcpip\..\{52407194-A84A-4255-8CF9-7A24824E3EF0}: NameServer = 61.1.96.69 61.1.96.71
shall i remove this?
__________________
I Love Photography. I Love Aperture. I Love Mac.
drgrudge is offline  
Old 07-04-2005, 11:35 PM   #7 (permalink)
Wise Old Owl
 
enoonmai's Avatar
 
Join Date: Oct 2004
Location: Parked diagonally in a parallel universe
Posts: 1,304
Default
LOL, in case you forgot, thats your DataOne DNS entries. You have absolutely no need of removing that.
__________________
Face it, kid! Provoking a reaction isn't the same thing as saying something significant - Calvin
A64 3000+@2.4G/Asus A8V-DLX/1G DDR400/BBA X800 XT PE/320G HGST SATA2
Playing FEAR XP/LSW2
enoonmai is offline  
Old 07-04-2005, 11:58 PM   #8 (permalink)
Another Brick in the Wall
 
drgrudge's Avatar
 
Join Date: Jul 2004
Location: Dubai/Chennai
Posts: 3,027
Default
OK..., i dint know abt BSNL thing.

And abt dot.exe , swat suggested to do a online scan..., it's a virus!
dot.exe - infected by not-a-virus:AdWare.180Solutions

Thanks for the help guys
__________________
I Love Photography. I Love Aperture. I Love Mac.
drgrudge is offline  
Old 08-04-2005, 12:00 AM   #9 (permalink)
Human Spambot
 
swatkat's Avatar
 
Join Date: Mar 2004
Location: India
Posts: 2,033
Default
180Solutions is not a Virus, but it's a Spyware in the guise of 180SearchAssistant Search toolbar for IE.
So, fix that entry in HJT and delete the file and run CCleaner and CleanUp! after this.
Also scan using AdAware once.
__________________
http://swatrant.blogspot.com/
swatkat is offline  
Old 08-04-2005, 12:05 AM   #10 (permalink)
Coming back to life ..
 
it_waaznt_me's Avatar
 
Join Date: Nov 2003
Location: A bit closer to heaven
Posts: 1,997
Default
Hmm That Dot.exe looks fishy to me ..
Anyways if you have installed this thing then its legitimate or send it to me .. Ill examine it more closely ...
__________________
Sleight of hand and twist of fate...
On a bed of nails she makes me wait...
And I wait without you ...
With or without you ..
----
Batty = Too Busy Now !!!
it_waaznt_me is offline  
 

Bookmarks

« Previous Thread | Next Thread »
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

 
Latest Threads
the FOOTBALL channel
- by Arsenal_Gunners
FAO Ice Cream Sanwich users
- by ico
Anonymous Strikes again!!
- by clinton
Language learners' discussion thread !! :D
- by icebags
National Telecom Policy 2012 Approved
- by ssk_the_gr8
Battlefield 3 Multiplayer Discussion
- by Charan
Should I buy Galaxy S2 now?
- by techlover
Diablo III Discussion
- by Gaurav Bhattacharjee
Dual Core Confusion!!!!
- by rahulpv102
Must Play PC Games / Suggestion
- by Piyush

Advertisement




All times are GMT +5.5. The time now is 12:48 AM.

Contact Us - Thinkdigit.com - Archive - Top

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2012, vBulletin Solutions, Inc.

Search Engine Optimization by vBSEO 3.3.2