FX Forum - Post your Hijackthis log here

• GSL

  7 Dec 05, 12:46

  kenna Infected by viruses , spyware , adware ???
  
  Post your Hijackthis Logs Here !!!
  
  1. Download HijackThis
  
  2. Scan it and then post the Log Files Here !!!
• alexkusu

  7 Dec 05, 12:51

  
  
• GSL

  7 Dec 05, 13:07

  
  
  The picture circled in red, Click on the "box" at the hijackthis and can click "Fix" it
  
  Is a virus, Trojan-Download.Win32.ConHook.i
• stellazio

  7 Dec 05, 13:11

  free anti spyware detector ar?
• alexkusu

  7 Dec 05, 13:14

  Originally posted by GSL:
  
  
  The picture circled in red, Click on the "box" at the hijackthis and can click "Fix" it
  
  Is a virus, [b]Trojan-Download.Win32.ConHook.i[/b]

  not much use.It'll show up in the next scan anyways
• GSL

  7 Dec 05, 14:16

  Originally posted by stellazio:

  free anti spyware detector ar?

  ya. but This is use to remove tough to remove spyware,virus,adware.
  
  Recommended for Expert use
• GSL

  7 Dec 05, 14:20

  Originally posted by alexkusu:

  not much use.It'll show up in the next scan anyways

  U use Windows XP Or ME
  
  There's this feature called System Restore in Windows XP and ME only which can "Roll Back" your system, if the system gone wrong.
  
  U must Turn Off the system restore when u remove because it will need "toss away" all the restore point just in case the system restore back up it.
  
  after finishing removing the malware, turn on the system restore
• alexkusu

  7 Dec 05, 14:21

  Originally posted by GSL:

  U use Windows XP Or ME
  
  There's this feature called System Restore in Windows XP and ME only which can "Roll Back" your system it system happen.
  
  U must Turn Off the system restore when u remove because it will need "toss away" all the restore point just in case the system restore back up it.
  
  after finishing removing the malware, turn on the system restore

  WinXp.. i tot use Hijack tools "delete on reboot" to delete it..but cant find the file. Apparently has been deleted by SpwareDoctor. U try before?
• GSL

  7 Dec 05, 14:34

  Originally posted by alexkusu:

  WinXp.. i tot use Hijack tools "delete on reboot" to delete it..but cant find the file. Apparently has been deleted by SpwareDoctor. U try before?

  Spyware Doctor already detect it If detect it , then go to Quarantine item and "toss away" all the Quarantine file then Turn off the system restore and scan again, after scanning and it is removed then turn on the system restore.
  
  Turning off the system restore "Toss away" all the restore point just in case system restore backed up the "containminated file"
• GSL

  7 Dec 05, 14:36

  Originally posted by alexkusu:

  WinXp.. i tot use Hijack tools "delete on reboot" to delete it..but cant find the file. Apparently has been deleted by SpwareDoctor. U try before?

  ya, it can be deleted on reboot
• alexkusu

  8 Dec 05, 09:21

  dosent seem to work...guess oni way is to reformat
• GSL

  8 Dec 05, 12:01

  Originally posted by alexkusu:

  dosent seem to work...guess oni way is to reformat

  Go to safe mode to remove the malicious file if it fail to remove on windows.
  
  Instruction on going to safe mode:
  
  1. Restart your computer
  
  2. Before the Windows XP loading screen, Quickly press the F8 key on the keyboard
  
  3. Select either "Safe mode with command Prompt" OR "safe mode with networking"
• GSL

  9 Dec 05, 15:32

  So does it work
• alexkusu

  9 Dec 05, 18:51

  Nope. Too embedded deep. Guess no choice... no other tools left. Reformat wen free
• GSL

  11 Dec 05, 14:18

  Try This Removal Tool.
  
  This Virus is also know as Trojan.Vundo(according to symantec website)
• ceecookie

  14 Dec 05, 16:46

  Logfile of HijackThis v1.99.1
  Scan saved at 16:27:07, on 14/12/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\System32\cisvc.exe
  C:\WINDOWS\runservice.exe
  C:\Program Files\Norton AntiVirus\navapsvc.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\WINDOWS\soundman.exe
  C:\PROGRA~1\NORTON~1\navapw32.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
  C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  C:\Program Files\Common Files\Totem Shared\Uninstall0001\upd.exe
  C:\WINDOWS\System32\AcerGoto.exe
  C:\Program Files\Winamp\winampa.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
  C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\WINDOWS\system32\cidaemon.exe
  C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
  C:\PROGRA~1\NETSCAPE\NETSCA~2\NETSCAPE.EXE
  C:\Documents and Settings\Default\Desktop\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.webshots.com/r/internal/start/client/RAND
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr7/*http://www.yahoo.com
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr7/*http://www.yahoo.com/ext/search/search.html
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr7/*http://www.yahoo.com
  R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr6/*http://www.yahoo.com
  R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll (file missing)
  N3 - Netscape 7: user_pref("browser.startup.homepage", "www.yahoo.com"); (C:\Documents and Settings\Default\Application Data\Mozilla\Profiles\default\zed5nycl.slt\prefs.js)
  N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRA%7E1%5CNETSCAPE%5CNETSCA%7E1%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Default\Application Data\Mozilla\Profiles\default\zed5nycl.slt\prefs.js)
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
  O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
  O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
  O2 - BHO: (no name) - {9E992732-295F-4987-8BE3-16FAC1639198} - (no file)
  O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\zh-sg\msntb.dll
  O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: GameBar - {4E7BD74F-2B8D-469E-C0FF-FD69B994BD7D} - C:\PROGRA~1\GAMERI~1\GameBar\gamebar.dll (file missing)
  O3 - Toolbar: (no name) - {FF905E0C-CFE9-4A90-AFFF-C13AF5D908F0} - (no file)
  O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\zh-sg\msntb.dll
  O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll (file missing)
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
  O4 - HKLM\..\Run: [SoundMan] soundman.exe
  O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
  O4 - HKLM\..\Run: [WINSTA~1.EXE] C:\WINDOWS\System\WINSTA~1.EXE -b
  O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
  O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
  O4 - HKLM\..\Run: [Uninstall0001] "C:\Program Files\Common Files\Totem Shared\Uninstall0001\upd.exe" LASTCALL!adverts.virtuaguy.com!StatsVirtuaGuy
  O4 - HKLM\..\Run: [AcerGoto] C:\WINDOWS\System32\AcerGoto.exe
  O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
  O4 - HKCU\..\Run: [\IEService.exe] C:\DOCUME~1\ALLUSE~1\APPLIC~1\IESERV~1\IEService.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: KeenValue.lnk = C:\Program Files\Common Files\KeenValue\keenvalue.exe
  O4 - Global Startup: WinZip Quick Pick.lnk = C:\Documents and Settings\Default\Desktop\WinZip\WZQKPICK.EXE
  O4 - Global Startup: Picture Package VCD Maker.lnk = ?
  O4 - Global Startup: Picture Package Menu.lnk = ?
  O4 - Global Startup: updater.lnk = C:\Program Files\Common Files\updater\wupdater.exe
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
  O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
  O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
  O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O15 - Trusted Zone: www.gunbound.com
  O15 - Trusted Zone: www.hotmail.com
  O15 - Trusted Zone: http://www.neopets.com
  O15 - Trusted Zone: www.superdudes.net
  O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540002} (CInstall Class) - http://www.wildtangent.com/webdrivers/webinstall/shockwave/Install.cab
  O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
  O16 - DPF: {6D5FCFCB-FA6C-4CFB-9918-5F0A9F7365F2} (GigexCtrl ActiveX) - http://www.gigex.com/tv/igor/gigexagent.dll
  O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) - http://www.wildtangent.com/install/wdriver/rpg/darkorbit/wildtangent/wtinst.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
  O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
• ceecookie

  14 Dec 05, 16:48

  double
• GSL

  15 Dec 05, 12:34

  ceecookie, Remove those highlighted in Red !!!
  
  C:\Program Files\Common Files\Totem Shared\Uninstall0001\upd.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.webshots.com/r/internal/start/client/RAND
  
  R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll (file missing)
  
  O2 - BHO: (no name) - {9E992732-295F-4987-8BE3-16FAC1639198} - (no file)
  
  O3 - Toolbar: GameBar - {4E7BD74F-2B8D-469E-C0FF-FD69B994BD7D} - C:\PROGRA~1\GAMERI~1\GameBar\gamebar.dll (file missing)
  
  O3 - Toolbar: (no name) - {FF905E0C-CFE9-4A90-AFFF-C13AF5D908F0} - (no file)
  
  O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQToolbar\toolbaru.dll (file missing)
  
  O4 - HKLM\..\Run: [Uninstall0001] "C:\Program Files\Common Files\Totem Shared\Uninstall0001\upd.exe" LASTCALL!adverts.virtuaguy.com!StatsVirtuaGuy
  
  O4 - HKCU\..\Run: [\IEService.exe] C:\DOCUME~1\ALLUSE~1\APPLIC~1\IESERV~1\IEService.exe
  
  O4 - Global Startup: KeenValue.lnk = C:\Program Files\Common Files\KeenValue\keenvalue.exe
  
  O4 - Global Startup: Picture Package VCD Maker.lnk = ?
  O4 - Global Startup: Picture Package Menu.lnk = ?
  O4 - Global Startup: updater.lnk = C:\Program Files\Common Files\updater\wupdater.exe
  
  O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program Files\ICQToolbar\toolbaru.dll/SEARCH.HTML
  
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  
• GSL

  15 Dec 05, 12:44

  ceecookie, Download the following software below and run the scan:
  
  1: ewido Security Suite
  
  2: Webroot Spy Sweeper V4.5
  
  After finishing scanning and removing those malicious thing, Turn Off System Restore then turn back on.
  
  Instruction on how to turn off system restore:
  
  1: Right Click "My Computer" Icon and Select "Properties"
  
  2: Under the "System restore" tab, click on "Turn off system restore on all drive" OR "Turn Off System restore".
  
  To turn back on just repeat the steps above.
• ceecookie

  15 Dec 05, 12:54

  Originally posted by GSL:

  ceecookie, Download the following software below and run the scan:
  
  1: ewido Security Suite
  
  2: Webroot Spy Sweeper V4.5
  
  After finishing scanning and removing those malicious thing, Turn Off System Restore then turn back on.
  
  Instruction on how to turn off system restore:
  
  1: Right Click "My Computer" Icon and Select "Properties"
  
  2: Under the "System restore" tab, click on "Turn off system restore on all drive" OR "Turn Off System restore".
  
  To turn back on just repeat the steps above.

  removed all the files u ask me to except for picture package..its the software for my camera
  
  then u ask me to dl the programs both or just one of em?
  
  turned off system restore...
• GSL

  15 Dec 05, 13:12

  Originally posted by ceecookie:

  removed all the files u ask me to except for picture package..its the software for my camera
  
  then u ask me to dl the programs both or just one of em?
  
  turned off system restore...

  Download Both of them and scan.
• ceecookie

  15 Dec 05, 13:20

  Originally posted by GSL:

  Download Both of them and scan.

  and then uninstall them right....
  
  anyway u must be a experience IT person..
  
  oh..is there any way of overclocking the computer without opening the motherboard...maybe just click a program and choose?Im thinking of overclocking by 12.5%
• GSL

  15 Dec 05, 14:51

  Originally posted by ceecookie:

  and then uninstall them right....
  
  anyway u must be a experience IT person..
  
  oh..is there any way of overclocking the computer without opening the motherboard...maybe just click a program and choose?Im thinking of overclocking by 12.5%

  
  
  For the overclocking: it can be change the setting in the BIOS.
• ceecookie

  15 Dec 05, 15:55

  done the scan for ewido...cleared 260 spyware files...now about to uninstall them and install the next one.....
  
  will spyware grow undetectable to a particular anti spyware program after some time?
• GSL

  15 Dec 05, 16:31

  Originally posted by ceecookie:

  done the scan for ewido...cleared 260 spyware files...now about to uninstall them and install the next one.....
  
  will spyware grow undetectable to a particular anti spyware program after some time?

  Yes, it will.
  
  Sometime must uninstall the anti-spyware program and reinstall it back.