1
   

Please tell me which of these I can safely delete from my pc

 
 
sloggy
 
Reply Sat 17 Jul, 2004 01:52 am
Hi, I've just done a 'hijack this' scan and the following came up.
Does anyone know which ones I can safely delete?
Your help is much appreciated. Thank you. :-)

Logfile of HijackThis v1.98.0
Scan saved at 3:23:36 PM, on 17/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
G:\WINDOWS\System32\smss.exe
G:\WINDOWS\system32\winlogon.exe
G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe
G:\WINDOWS\system32\spoolsv.exe
G:\WINDOWS\Explorer.EXE
G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
G:\Program Files\Analog Devices\SoundMAX\Smtray.exe
G:\Program Files\QuickTime\qttask.exe
G:\Program Files\Common Files\Symantec Shared\ccApp.exe
G:\WINDOWS\System32\ctfmon.exe
G:\Program Files\Messenger\msmsgs.exe
G:\Program Files\Norton AntiVirus\navapsvc.exe
G:\Program Files\Norton Internet Security\NISUM.EXE
G:\WINDOWS\System32\svchost.exe
G:\Program Files\Norton Internet Security\ccPxySvc.exe
G:\WINDOWS\System32\wuauclt.exe
G:\WINDOWS\System32\wpabaln.exe
G:\Program Files\Internet Explorer\iexplore.exe
G:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - G:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - G:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - G:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [Smapp] G:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [DrvListnr] G:\Program Files\Analog Devices\SoundMAX\DrvListnr.exe
O4 - HKLM\..\Run: [QuickTime Task] "G:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "G:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "G:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "G:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] G:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - Global Startup: Microsoft Office.lnk = G:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://G:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - G:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - G:\WINDOWS\web\related.htm
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.apple.com/saba/us/win/QuickTimeInstaller.exe
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3ED0227C-8BDE-46E1-879E-A9073497074D}: NameServer = 203.12.160.35,203.12.160.36
O17 - HKLM\System\CS1\Services\Tcpip\..\{3ED0227C-8BDE-46E1-879E-A9073497074D}: NameServer = 203.12.160.35,203.12.160.36
  • Topic Stats
  • Top Replies
  • Link to this Topic
Type: Discussion • Score: 1 • Views: 1,822 • Replies: 6
No top replies

 
timberlandko
 
  1  
Reply Sat 17 Jul, 2004 10:01 am
At a quick glance, nothing there leaps out as yuckware, though there are a couple resource hogs and unnecessary startups. Why do you think you should delete anything? Are you having homepage or search redirect problems, system or browser hangups, frequent popups, or other problems?
0 Replies
 
sloggy
 
  1  
Reply Sun 18 Jul, 2004 07:42 am
Problems with hackers...
I'm looking for some spyware, trojans etc.
0 Replies
 
timberlandko
 
  1  
Reply Sun 18 Jul, 2004 12:58 pm
OK, but as I said, I didn't really notice anything glaring in your HJT log, which is why I asked what specific symptoms you were suffering. "Problems with hackers" isn't a very illuminating response. You don't mention any specific problem, so this is sorta "shooting in the dark". But whatever, lets walk through it a little more thoroughly, and I'll let you know what I think. What you decide to do is up to you.

Now, to get to work:

Your Running Processes:
G:\WINDOWS\System32\smss.exe
Session Manager Subsystem, a normal Windows component which if legitimate will appear in %Systemroot%\Windows\System32. In your case, %systemroot% will be "G:\". While yuckware frequently mimics legitimate filenames, it generally (though not always) tips itself off by a variation on the legitimate application's filename, path, or directory. This entry displays the appropriate filename, path, and directory. Leave it alone.

G:\WINDOWS\system32\winlogon.exe
Another normal Windows component, the user logon to the system, displaying the appropriate filename, path and directory attributes. Leave it alone.

G:\WINDOWS\system32\services.exe
G:\WINDOWS\system32\lsass.exe
G:\WINDOWS\system32\svchost.exe
G:\WINDOWS\System32\svchost.exe

All normal Windows components, displaying appropriate attributes, inter-related and codependent, necessary, leave them alone.

G:\WINDOWS\system32\spoolsv.exe
Printer related, normal Windows component displaying appropriate attributes. Leave it alone.

G:\WINDOWS\Explorer.EXE
Explorer.EXE is the user interface shell of Windows. A normal windows component, displaying the appropriate attributes. Leave it alone.

G:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
A component of Your Norton Security/Privacy software, displaying appropriate attributes. Leave it alone.

G:\Program Files\Analog Devices\SoundMAX\Smtray.exe
Provides system tray access to functions of SoundMax integrated audio. The filename, path and directory are appropriate for this entry. While not necessary to the function either of Windows or of the SoundMax audio chipset, it offers the user some convenience. I'd leave it alone.

G:\Program Files\QuickTime\qttask.exe
The Apple QuickTime media player application. Displaying the appropriate attributes, this is a benign entry unrelated to yuckware. However, there is no need for Apple's Quicktime application to launch at startup. I would disable it on QuickTime's configuration settings page, deselecting "Start with Windows"; essentially its a freeloading resource hog, and Quicktime can be launched on demand as required from its location in Programs or from a desktop or taskbar shortcut.

G:\Program Files\Common Files\Symantec Shared\ccApp.exe
Another component of your Norton software, and displaying the appropriate attributes. Leave it alone.

G:\WINDOWS\System32\ctfmon.exe
A normal, more or less unavoidable though more or less useless component of the Microsoft Office Product family, displaying the appropriate attributes, its actual name is "Alternative User Input Text Input Processor for Office"; it provides support for speech and handwriting recognition, among other things. If you use Office Products, there isn't much you can do about it from a practical standpoint. Sort of a resource hog, but most folks, even though they may have little use for it, should leave it alone. If stopped or disabled, it will merely start itself back up the next time an Office application is invoked. It can be uninstalled, but that can be tricky, tedious, hardly worth the effort, and if mot dome precisely right, can impair other functionality of Office products. Gee, thanks, Microsoft.

G:\Program Files\Messenger\msmsgs.exe
MSN Messenger traybar; displaying the appropriate attributes, this, while not required is benign. I would prefer to invoke my messaging client only when I wanted to use it. I'd disable its autostart function on MSN Messenger's configuration settings page, but your call.

G:\Program Files\Norton AntiVirus\navapsvc.exe
Another componet of your Norton software, and displaying appropriate attributes. Leave it alone.

G:\Program Files\Norton Internet Security\NISUM.EXE
Another componet of your Norton software, and displaying appropriate attributes. Leave it alone.

G:\WINDOWS\System32\svchost.exe
A normal Windows component, displaying appropriate attributes, on which any number of other functions depend. Leave it alone.

G:\Program Files\Norton Internet Security\ccPxySvc.exe
More Norton, displaying proper attributes. Leave it alone.

G:\WINDOWS\System32\wuauclt.exe
Windows AutoUpdate Client, a normal Windows component, displaying the appropriate attributes. Unnecessary, its pretty much another "Gee, thanks, Microsoft" deal IMO, but since most folks won't take the time and effort to keep Windows up to date on their own, I'll reluctantly say leave it alone.

G:\WINDOWS\System32\wpabaln.exe
A normal Windows component, Windows Product Activation Balloon, displaying appropriate attributes. One more "Gee, thanks, Microsoft" thing.

G:\Program Files\Internet Explorer\iexplore.exe
G:\Program Files\Internet Explorer\iexplore.exe
This shows that, contrary to instructions, at the time you ran HiJackThis you had a couple of browser windows open.

C:\Program Files\HijackThis.exe
Self explanatory; this is HiJackThis. Of course its running.


Your 02 section, Browser Helper Objects
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - G:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
A legitimate component of Adobe's Acrobat Reader, displaying appropriate attributes. Leave it alone.

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll
A legitimate component of PepiMk Software's Spybot Search and Destroy, displaying appropriate attributes. Leave it alone.

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - G:\Program Files\Norton AntiVirus\NavShExt.dll
A normal component of Norton Antivirus, displaying appropriate attributes. Leave it alone.

Your 03 section, Toolbars and Extra Buttons
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - G:\WINDOWS\System32\msdxm.ocx
A normal component of Windows Media Player, displaying appropriate attributes. Leave it alone.

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - G:\Program Files\Norton AntiVirus\NavShExt.dll
A normal component of Norton Antivirus, displaying appropriate attributes. Leave it alone.

Your 04 section, items that start with Windows.
O4 - HKLM\..\Run: [Smapp] G:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [DrvListnr] G:\Program Files\Analog Devices\SoundMAX\DrvListnr.exe
Normal components of your SoundMax audio, previously discussed, displaying appropriate attributes. Leave them alone.

O4 - HKLM\..\Run: [QuickTime Task] "G:\Program Files\QuickTime\qttask.exe" -atboottime
Apple's "Quicktime", as previously discussed, displaying appropriate attributes. As I said before, I'd eliminate Quicktime from my auto-startups.

O4 - HKLM\..\Run: [ccApp] "G:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "G:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"

More Norton, and displaying appropriate attributes. Leave them alone.

O4 - HKCU\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\ctfmon.exe
Normal, unnecessary, but as previously mentioned, "Gee, thanks, Microsoft"

O4 - HKCU\..\Run: [MSMSGS] "G:\Program Files\Messenger\msmsgs.exe" /background
As I said earlier, I see no reason to have my messaging client come along for the ride when Windows launches, then just sit there doing nothing but pointlessly consuming resources, but your call.

O4 - HKCU\..\Run: [Symantec NetDriver Monitor] G:\PROGRA~1\SYMNET~1\SNDMon.exe
More Norton, displaying proper attributes. Leave it alone.

O4 - Global Startup: Microsoft Office.lnk = G:\Program Files\Microsoft Office\Office10\OSA.EXE
Those wonderful, wacky Microsoft Folks want to make sure you find it more convenient to use their office productivity stuff than any alternative provided by anyone else, so the Office Startup Assistant hops on the wagon when Windows rolls out of the barn. There's no need for Office to start with Windows unless you actually use some component of Office all the time. Unfortunately, its pretty much another "Gee, thanks Microsoft" deal if you use any Office component (which, BTW, includes Microsoft Works). With a little effort and knowledge of what to do and how to do it, you can take more control of Office than Microsoft would prefer for you to have, but for most users doing so is worth neither the time nor effort. Yup, "Gee, thanks, Microsoft"

Your 08 section, items in your Right-click options menu
O8 - Extra context menu item: E&xport to Microsoft Excel - res://G:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
Displaying appropriate attributes, this entry is just more Office stuff to be "thankful" for.

Your 09 section, extra items in your IE toolbar.
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - G:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - G:\WINDOWS\web\related.htm

These are Alexa related, and, IMO, not really yuckware. None the less, I would get rid of them, on general principle. More on this in a bit.

Your 016 section, downloaded program files/ActiveX controls. You can delete all of these if you wish, but generally, that's counterproductive and usually pointless; the associated application or web page will just reinstall them as needed.
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.apple.com/saba/us/win/QuickTimeInstaller.exe
A component of the Quicktime application. Harmless. Leave it alone.

O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
Norton. Leave it alone.

Your 017 section, TCPIP/Domain Nameservers
O17 - HKLM\System\CCS\Services\Tcpip\..\{3ED0227C-8BDE-46E1-879E-A9073497074D}: NameServer = 203.12.160.35,203.12.160.36
O17 - HKLM\System\CS1\Services\Tcpip\..\{3ED0227C-8BDE-46E1-879E-A9073497074D}: NameServer = 203.12.160.35,203.12.160.36

These listings are apprpriate if your ISP is TGP Internet ... which it is. Leave them alone.

Now, with no other browser windows open, rerun HiJackThis and have it "fix"
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - G:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - G:\WINDOWS\web\related.htm


Clear your Temporary Internet files, deleting all offline content. Find and empty (just delete the items within, not the folders themselves) your %systemroot%\Temp, %systemroot%\Windows\temp (or temporary), and esach %systemroot%\Windows\Documents and Settings\(any username)\Temp folders.

Empty your recycle bin.

Be certain you have the latest version of Spybot S&D, which is V 1.3 or later. If yours is an older version, uninstall it through Add/Remove Programs, the delete the Spybot folder from your %systemroot%\Programs folder, and, if present, remove the Spybot entry from your Startup folder, then install and update the current version. The updated detection list should be July 9 '04 or later. Read the Tutorial and the FAQand read the documentation under Spybot's "Help" file. Configure Spybot to "Immunize", and to enable both its "Resident" and "Teatimer" features. Be certain Spybot is configured to not ignore anything at least this first few times around. Read the instuctions. It is a good idea to augment Spybot's protection with JavCool Software's SpywareBlaster.. As always, read, understand, and follow all instructions.

Download, install, update, and configure LavaSoft's AdAware, again reading, understanding, and following all instructions.

Disconnect from the internet, boot into safemode, run Spybot, and let it "Fix" whatever it finds. If it asks to run again on next boot to finish repairs, fine ... reboot back into safemode and let it go. Run it again anyway. If and when it comes up empty, fine. Empty your recycle bin, reboot into safemode, and follow the same procedure with AdAware, again running the app at least twice to be sure it has found and fixed all it can.

When that has been done, reboot normally and run Spybot and and Adaware one after the other once again, letting each fix anything they find ... though they should find nothing.

Now, with WinXP's built-in firewall enabled, reconnect to the internet and go directly to Windows Update and make certain you're fully up to date. Its not a bad idea to take advantage of Microsoft's Windows Baseline Security Analyzer while you're there. Of course, read, understand, and follow the instructions.

Get yourself a third-party firewall, over and above Windows XP's tag-along. There are plenty of free and low cost firewalls available, but whatever you choose, be sure to keep it updated, and configure it properly.
0 Replies
 
shortbus
 
  1  
Reply Thu 29 Jul, 2004 04:50 pm
Nicely done!,
Generally that's a lot of surfing to get half the info you've put in that list, and when finished the first items have been forgotten. I have always been suspect of the capital letters in my explorer.EXE, so that puts me at ease a bit.
Correct me if i'm wrong, but I thought 'Print Spooler' was for printing in a network environment.
eg. If co-worker is printing and you attempt to print, this service will put you in line, so when co-worker is finished your printing will begin.
In other words, for a stand alone machine it could not be more useless.
`````````
On a completely different subject, anybody ever have Norton unable to run and also unable to uninstall?
0 Replies
 
timberlandko
 
  1  
Reply Fri 30 Jul, 2004 02:57 pm
Well, thanks, shortbus, and welcome to A2K. Not a helluva lotta googling involved there, really, mostly just bits and pieces picked up and rememberered from personally having broken and repaired Windows a whole buncha times, with and without reference to yuckware. I've found it helpful to learn a lot about what makes Windows tick, 'cause I just won't leave it alone. Somethin' that frequently occurs to me, usually just afer hittin' "Enter", is "Damn! That prolly wasn't a very good idea" Embarrassed

As for your Norton problem, likely the best thing to do is to do a full reinstall over the top of the exising application, then reboot as directed. Use Add/Remove Programs to uninstall it, reboot, then hunt down and delete any files and folders containing "NAV", "Norton", or "Symantec" in their names, then reboot once more. That should do it for you. If not, email Norton/Symantec's support, detailing what your problem is and what you've tried to do to remedy it. You may haver to make a few registry edits to clear it up, but they should direct you to where to go to get that done. They're usually pretty good about that sorta stuff, though it can take 'em a few days to get back to you.
And print spooling is not exclusively for network printing; a printjob usually is qued up on the local machine, too, as opposed to being dumped whole straight to the printer.
0 Replies
 
shortbus
 
  1  
Reply Tue 31 Aug, 2004 03:59 pm
Got it out of the system (I had already done searches in the registry, except for NAV), they really scatter their files everywhere.
Never been a big fan of Norton, I find I install for one pupose, and suddenly my garbage can is 'protected' and I've got other services running I never intended to have.
I went back to AVG, but recently am not thrilled with them either (not really them to blame when the problem is not a virus but spyware).
0 Replies
 
 

Related Topics

Clone of Micosoft Office - Question by Advocate
Do You Turn Off Your Computer at Night? - Discussion by Phoenix32890
The "Death" of the Computer Mouse - Discussion by Phoenix32890
Windows 10... - Discussion by Region Philbis
Surface Pro 3: What do you think? - Question by neologist
Windows 8 tips thread - Discussion by Wilso
GOOGLE CHROME - Question by Setanta
.Net and Firefox... - Discussion by gungasnake
Hacking a computer and remote access - Discussion by trying2learn
 
  1. Forums
  2. » Please tell me which of these I can safely delete from my pc
Copyright © 2025 MadLab, LLC :: Terms of Service :: Privacy Policy :: Page generated in 0.05 seconds on 12/24/2025 at 04:44:45