Author Topic: Win32:Trojan-gen. {Other} Hijack log too  (Read 6968 times)

0 Members and 1 Guest are viewing this topic.

Liquid_force

  • Guest
Win32:Trojan-gen. {Other} Hijack log too
« on: May 28, 2005, 03:54:42 AM »
Hello,
My on-access scanner has been telling me I have this virus for a few weeks now.

Win32:Trojan-gen. {Other}

I've run regular scans, boot scans, and safe mode scans and nothing seems to be resolving the problem.

I've also had the on-access scanner detect -
Win32:Direbu [Adw]

Here is my HT log...

Logfile of HijackThis v1.99.1
Scan saved at 8:51:23 PM, on 5/27/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Documents and Settings\All Users\Application Data\avservice.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\winnt\system32\wootman.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe
C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATI9AA.EXE
C:\winnt\system32\packager.exe
C:\Program Files\epson\EPSON CardMonitor\EPSON CardMonitor1.2.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Justin1\My Documents\Security\hijack this\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINNT\system32\Userinit.exe
O2 - BHO: sPeerObj Class - {00000097-7C67-4BA6-8B42-05128941688A} - C:\WINNT\speeryox.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [wootman] c:\winnt\system32\wootman.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [morphstb] C:\WINNT\morphstb.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe"
O4 - HKCU\..\Run: [Registry Cleaner] "C:\Program Files\Registry Cleaner\RegClean.exe"
O4 - HKCU\..\Run: [EPSON Stylus CX4600 Series] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATI9AA.EXE /P26 "EPSON Stylus CX4600 Series" /M "Stylus CX4600" /EF "HKCU"
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: EPSON CardMonitor.lnk = C:\Program Files\epson\EPSON CardMonitor\EPSON CardMonitor1.2.exe
O16 - DPF: {495DEA80-49C2-4891-94CD-C2016615D16F} (ProductView Control) - http://216.235.87.77/spx/servlet/websearch/pvcadview.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by11fd.bay11.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
O16 - DPF: {F7A05BAC-9778-410A-9CDE-BFBD4D5D2B7F} (iPIX Media Send Class) - http://216.249.24.60/code/iPIX-ImageWell-ipix.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: AVCore (SrvMain) - Unknown owner - C:\Documents and Settings\All Users\Application Data\avservice.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Unknown owner - C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe (file missing)



Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 87078
  • No support PMs thanks
Re: Win32:Trojan-gen. {Other} Hijack log too
« Reply #1 on: May 28, 2005, 01:38:11 PM »
What was the filename, where was it found
  example (C:\windows\system32\infected-filename.xxx)?

You would appear to be running two resident scanners at the same time, this can cause conflict and is not recommended.

For an on-line analysis - HiJackThis Log file - On-line Analysis
Ignore any 023 reference to avast processes, this is a hiccup in the HJT 1.99.1 (especially missing file entry for avast), if you need any help with any of the analysis let us know.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.10.6038 (build 22.10.7633.734) UI 1.0.733/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Liquid_force

  • Guest
Re: Win32:Trojan-gen. {Other} Hijack log too
« Reply #2 on: May 28, 2005, 06:35:30 PM »
Most recent detection was -
5/28/2005 11:14:16 AM   SYSTEM   516   Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\DOCUME~1\Justin1\LOCALS~1\Temp\THI39DE.tmp\speeryox.dll" file. 

I believe I have made some progress, and I may finally have gotten it deleted, but there are still some unknowns in my HT log.
Thanks for the help.

Logfile of HijackThis v1.99.1
Scan saved at 11:33:52 AM, on 5/28/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\Documents and Settings\All Users\Application Data\avservice.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe
C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATI9AA.EXE
C:\Program Files\epson\EPSON CardMonitor\EPSON CardMonitor1.2.exe
C:\Documents and Settings\Justin1\My Documents\Security\hijack this\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINNT\system32\Userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe"
O4 - HKCU\..\Run: [Registry Cleaner] "C:\Program Files\Registry Cleaner\RegClean.exe"
O4 - HKCU\..\Run: [EPSON Stylus CX4600 Series] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATI9AA.EXE /P26 "EPSON Stylus CX4600 Series" /M "Stylus CX4600" /EF "HKCU"
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: EPSON CardMonitor.lnk = C:\Program Files\epson\EPSON CardMonitor\EPSON CardMonitor1.2.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by11fd.bay11.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
O16 - DPF: {F7A05BAC-9778-410A-9CDE-BFBD4D5D2B7F} (iPIX Media Send Class) - http://216.249.24.60/code/iPIX-ImageWell-ipix.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: AVCore (SrvMain) - Unknown owner - C:\Documents and Settings\All Users\Application Data\avservice.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Unknown owner - C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe (file missing)

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 87078
  • No support PMs thanks
Re: Win32:Trojan-gen. {Other} Hijack log too
« Reply #3 on: May 28, 2005, 06:52:02 PM »
Have you tried the on-line analysis in the link I gave you?

If so which unknowns in your HJT log?

Have you tried using a google search for the unknown items/entries? - I don't use w2k so they may be unknown to me and I would use google to check them anyway.

Is there a reason for using multiple resident AVs?
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.10.6038 (build 22.10.7633.734) UI 1.0.733/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Liquid_force

  • Guest
Re: Win32:Trojan-gen. {Other} Hijack log too
« Reply #4 on: May 28, 2005, 07:04:33 PM »
Have you tried the on-line analysis in the link I gave you?
Yes

Quote
If so which unknowns in your HJT log?
C:\Documents and Settings\All Users\Application Data\avservice.exe -- This seems ok - something to do with Avast?

C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATI9AA.EXE -- I believe this is ok - has something to do with my printer/scanner and shows up as an unknown later on in the file...
O4 - HKCU\..\Run: [EPSON Stylus CX4600 Series] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATI9AA.EXE /P26 "EPSON Stylus CX4600 Series" /M "Stylus CX4600" /EF "HKCU"

O4 - Startup: PowerReg Scheduler V3.exe

O16 - DPF: {F7A05BAC-9778-410A-9CDE-BFBD4D5D2B7F} (iPIX Media Send Class) - http://216.249.24.60/code/iPIX-ImageWell-ipix.cab

O23 - Service: AVCore (SrvMain) - Unknown owner - C:\Documents and Settings\All Users\Application Data\avservice.exe

O23 - Service: Trend NT Realtime Service (Tmntsrv) - Unknown owner - C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe (file missing)



Quote
Have you tried using a google search for the unknown items/entries? - I don't use w2k so they may be unknown to me and I would use google to check them anyway.

Quote
Is there a reason for using multiple resident AVs?
the only other service besides avast I knew was running was McAfee firewall.  I don't have it running anymore.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67235
Re: Win32:Trojan-gen. {Other} Hijack log too
« Reply #5 on: May 28, 2005, 07:13:57 PM »
C:\Documents and Settings\All Users\Application Data\avservice.exe -- This seems ok - something to do with Avast?
O23 - Service: AVCore (SrvMain) - Unknown owner - C:\Documents and Settings\All Users\Application Data\avservice.exe
Seems to be AntiVir related, not avast.

O23 - Service: Trend NT Realtime Service (Tmntsrv) - Unknown owner - C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe (file missing)
Did you uninstall PC-Cillin correctly? Seems that the service is still there...
The best things in life are free.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 87078
  • No support PMs thanks
Re: Win32:Trojan-gen. {Other} Hijack log too
« Reply #6 on: May 28, 2005, 10:22:49 PM »
Quote
C:\Documents and Settings\All Users\Application Data\avservice.exe -- This seems ok - something to do with Avast?

A google search for avservice.exe will show it is nothing to do with avast, probably a remnant of AVG or as Tech said Anti-Vir.

Quote
O4 - Startup: PowerReg Scheduler V3.exe
Use google to search for the filename at the end of the path/string, that should give you an indication of what the program is and if you legitimately installed it, e.g. v3.exe:
http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=V3.exe the first hit in the search results - http://forum.osnn.net/archive/index.php/t-40746.html shows it to be adware, so you should fix it in hijackthis.

Sorry if it seems we are not being helpful, we are trying to teach you how to use the tools available to you.

You seem to have remnants of two other AVs, if you aren't using them, fix the entries in HJT and find the associated files they are calling if they are there delete them.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.10.6038 (build 22.10.7633.734) UI 1.0.733/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Liquid_force

  • Guest
Re: Win32:Trojan-gen. {Other} Hijack log too
« Reply #7 on: May 29, 2005, 04:17:44 AM »
thanks for all the help.

Everything seems to be taken care of except the pc-cillin file.  I've tried to re-install the program so I can delete it -- it wouldn't install.  I've even gone in to program files and deleted the trend micro folder, rebooted, and --

C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe (file missing)

Still comes up in my HT scan.

Doesn't appear to be much of a problem.  I guess I'll just have to live with it.

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 87078
  • No support PMs thanks
Re: Win32:Trojan-gen. {Other} Hijack log too
« Reply #8 on: May 29, 2005, 02:03:05 PM »
can you run msconfig in w2k (or its equivalent)? if so check the startup tab and untick the entry for Tmntsrv.exe.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.10.6038 (build 22.10.7633.734) UI 1.0.733/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67235
Re: Win32:Trojan-gen. {Other} Hijack log too
« Reply #9 on: May 29, 2005, 04:40:21 PM »
C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe
This information should be on Windows Registry.
If you know how to deal with, you can try to save (bakcup) the registry key and then deleting it.
At least, can you search the Registry and post here the registry path for that value.
The best things in life are free.

Liquid_force

  • Guest
Re: Win32:Trojan-gen. {Other} Hijack log too
« Reply #10 on: May 29, 2005, 05:32:31 PM »
it seems I was able to get everything stopped using msconfig.
Again, I appreciate your help and time.

Logfile of HijackThis v1.99.1
Scan saved at 10:27:45 AM, on 5/29/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe
C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATI9AA.EXE
C:\Program Files\epson\EPSON CardMonitor\EPSON CardMonitor1.2.exe
C:\Documents and Settings\Justin1\My Documents\Security\hijack this\HijackThis.exe

F2 - REG:system.ini: UserInit=C:\WINNT\system32\Userinit.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe"
O4 - HKCU\..\Run: [Registry Cleaner] "C:\Program Files\Registry Cleaner\RegClean.exe"
O4 - HKCU\..\Run: [EPSON Stylus CX4600 Series] C:\WINNT\system32\spool\DRIVERS\W32X86\3\E_FATI9AA.EXE /P26 "EPSON Stylus CX4600 Series" /M "Stylus CX4600" /EF "HKCU"
O4 - Global Startup: EPSON CardMonitor.lnk = C:\Program Files\epson\EPSON CardMonitor\EPSON CardMonitor1.2.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by11fd.bay11.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINNT\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe


Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 87078
  • No support PMs thanks
Re: Win32:Trojan-gen. {Other} Hijack log too
« Reply #11 on: May 29, 2005, 06:24:34 PM »
Happy to have helped, hope you learned something in the process.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 22.10.6038 (build 22.10.7633.734) UI 1.0.733/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security