Help with Hijack This!

Factual Questions
1

My browser keeps shutting down, so that is why I am posting this here.

I have run Spybot and AdAware, and Hijack this. I need to get some advice on the outcome of the Hijack This results, but everytime I get close to posting on the other messageboards, I get shut down.

OS–XP Home version

Here is the list from Hijack This. If anyone can help, I would be very appreciative.

Logfile of HijackThis v1.99.1
Scan saved at 4:42:56 PM, on 2/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe
C:\Program Files\Juno6\exec.exe
C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Juno6\exec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe
C:\Program Files\Trend Micro\PC-cillin 2000\Pop3Trap.exe
C:\Program Files\Trend Micro\PC-cillin 2000\PNTIOMON.EXE
C:\Program Files\Trend Micro\PC-cillin 2000\pccntupd.exe
C:\DOCUME~1\user\LOCALS~1\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://my.juno.com/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.juno.com/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.juno.com/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.juno.com/s/search?r=minisearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.juno.com/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.juno.com/s/search?r=minisearch
R3 - URLSearchHook: URLSearchHook Class - {37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - C:\Program Files\JUSearch\SearchEnh1.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: JunoBar - {5854FAC4-5BF0-47DD-B5A9-A5EA8CFF3CF4} - C:\Program Files\Juno6\Toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM…\Run: [Pop3trap.exe] “C:\Program Files\Trend Micro\PC-cillin 2000\Pop3trap.exe”
O4 - HKLM…\Run: [WebTrapNT.exe] “C:\Program Files\Trend Micro\PC-cillin 2000\WebTrapNT.exe”
O4 - HKLM…\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM…\RunOnce: [SpybotSnD] “C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe” /autocheck
O4 - HKCU…\Run: [Juno_uoltray] C:\Program Files\Juno6\exec.exe regrun
O4 - HKCU…\Run: [spc_w] “C:\Program Files\JUSearch\juspc.exe” -w
O4 - Global Startup: Real-time Monitor.lnk = ?
O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip…{82496917-957E-4F2C-9A38-BE02DE73372F}: NameServer = 64.136.20.121 64.136.28.121
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Inc. - C:\Program Files\Trend Micro\PC-cillin 2000\Tmntsrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZONELABS\vsmon.exe

2

A better idea, and one more likely to get you some actual help, is to post this at spywareinfo.com. They have experts who really do help people.

http://forums.spywareinfo.com/

3

I just looked at your post, and I hate to say it, but I couldn’t see any lines that stood out as being malware.

Actually, one file you have running, WUAUCLT.EXE, COULD be a trojan. Or, it could be a Windows system file.
Read more here:
http://www.sophos.com/virusinfo/analyses/trojcultb.html

A question for you: Do you actually wish to have Juno software on your PC?
When your browser shuts down, is it just the browser?
Does the rest of the computer act up?

4

Alright. I finally got back. I have fought this mother for ten hours! It ends up I had some sort of Win.yadayada virus. Seems to be all on the clear now. A question for you: Do you actually wish to have Juno software on your PC?
When your browser shuts down, is it just the browser?
Does the rest of the computer act up?

[QUOTE]

The whole thing was going crazy. Slow running and what have you. Is there a problem with Juno? If so, I have no problem changing ISP’s.

Thanks

5

I know of no reported major issues with Juno.
I simply asked so I could rule out the Juno references in your log file from being hiding places for spyware.
If you didn’t have Juno loaded, but had those references, I would have begun looking for Spyware/etc masquerading as Juno.