| View previous topic :: View next topic |
| Author |
Message |
simsjustin
Cadet

 Joined: Feb 16, 2005 Posts: 5 Location: USA
|
Posted: Thu Feb 17, 2005 1:40 am Post subject: winlogon |
|
|
hijackthis wants to fix "Global Startup-winlogon" but it cant because it is always running and i cant close this using the task mgr. It calls it a critical process, also i cant delete it using search. please help because im sure this is what is hijacking my browsers.
|
|
| Back to top |
|
 |
Robin
Site Admin Phishing Squad Team Lead
 Joined: Oct 15, 2003 Posts: 8930
|
Posted: Thu Feb 17, 2005 6:01 pm Post subject: |
|
|
Please wait for one of the 1st Responders or Security Experts to assist you with your log. Just because something is listed by hijackthis, that doesn't mean it requires fixing.
|
|
| Back to top |
|
 |
simsjustin
Cadet

 Joined: Feb 16, 2005 Posts: 5 Location: USA
|
Posted: Thu Feb 17, 2005 11:47 pm Post subject: |
|
|
here is my hijakthis logfile
|
|
| Back to top |
|
 |
simsjustin
Cadet

 Joined: Feb 16, 2005 Posts: 5 Location: USA
|
Posted: Thu Feb 17, 2005 11:47 pm Post subject: |
|
|
Logfile of HijackThis v1.99.0
Scan saved at 5:45:37 PM, on 2/17/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\aaksrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Advanced Anti Keylogger\aak.exe
C:\Program Files\interMute\SpySubtract\SpySub.exe
C:\PROGRA~1\Yahoo!\browser\ybrowser.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Documents and Settings\April\Local Settings\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://letgohome.com/hp.htm?id=9
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://letgohome.com/hp.htm?id=9
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://letgohome.com/hp.htm?id=9
O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} - C:\WINDOWS\System32\W8C6S4~1.DLL (file missing)
O4 - HKLM\..\Run: [Control handler] C:\WINDOWS\System32\yi70x1o31hy3jvthd.exe
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.0\THGuard.exe"
O4 - HKCU\..\Run: [AAK] C:\Program Files\Advanced Anti Keylogger\aak.exe /silent
O4 - Global Startup: SpySubtract.lnk
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.static.topconverting.com
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.static.topconverting.com (HKLM)
O20 - AppInit_DLLs: w8c6s4xcm66s.dll, system32\aakah.dll
O23 - Service: aaksrv - Spydex, Inc. - C:\WINDOWS\System32\aaksrv.exe
|
|
| Back to top |
|
 |
Robin
Site Admin Phishing Squad Team Lead
 Joined: Oct 15, 2003 Posts: 8930
|
Posted: Fri Feb 18, 2005 4:24 am Post subject: |
|
|
Your log wont be answered in this forum. Since you have already got one posted in the Hijackthis forum, please wait for one of our staff to assist you there.
|
|
| Back to top |
|
 |
|
|