Webmaster Forum

Ezilon Directory   PR6 Link Building Service   V7N Directory
Go Back   Webmaster Forum > The Webmaster Forums > Forum Lobby > Computers & Internet
Post Your HijackThis logs here Post Your HijackThis logs here
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

Computers & Internet For all those computer related discussions.

Reply
Page 10 of 11 < 123456789 10 11 >
 
LinkBack Thread Tools Display Modes
Old 11-13-2007, 10:16 AM   #181 (permalink)
Contributing Member
 
Join Date: 08-30-07
Location: North Hollywood
Posts: 124
iTrader: 4 / 100%
Latest Blog:
None

k594 is liked by many
nEW LOG
ok here is my new log after running the programs u suggested please have a look


also if u could point me in the direction of a good firewall id appriciate it
Attached Files
File Type: txt log.txt (4.3 KB, 41 views)
k594 is offline  
Add Post to del.icio.us
Reply With Quote
Old 11-13-2007, 11:12 AM   #182 (permalink)
Contributing Member
 
oddjob's Avatar
 
Join Date: 10-25-06
Location: London, U.K.
Posts: 106
iTrader: 0 / 0%
Latest Blog:
None

oddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the rough
You still have Trojan trouble there.

Update all three programs to their latest definitions, scan your computer with them again and let them fix what they can.


Now open HJT again ... click on 'Do a System Scan Only'... put tick/check marks next to these entries IF still present ...

O4 - HKLM\..\RunOnce: [1] C:\WINDOWS\system32\cmd.exe /c erase "C:\DOCUME~1\H\LOCALS~1\Temp\AcsUninstall.exe"

O4 - HKLM\..\RunOnce: [2] C:\WINDOWS\system32\cmd.exe /c erase "C:\DOCUME~1\H\LOCALS~1\Temp\AcsUninstallRes.d ll"

O4 - HKLM\..\RunOnce: [3] C:\WINDOWS\system32\cmd.exe /c erase "C:\DOCUME~1\H\LOCALS~1\Temp\shfolder.dll"


Remember to close ALL open browser windows – including this one – before clicking on “Fix Checked” at the foot of the HijackThis window.

*******************

Empty your recycle bin again (Ccleaner should have already done it twice).

*******************

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 6 to your desktop from here ……
    http://javadl.sun.com/webapps/downlo...BundleId=12798
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check/tick any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then install the newest version by double-clicking the update file you just downloaded to your desktop.



Post a fresh HJT log AND AN UPDATE ON WHAT ISSUES YOU STILL HAVE WITH THE COMPUTER.


OJ
__________________
“A computer lets you make more mistakes faster than any other invention with the possible exceptions of handguns and Tequilla” Mitch Ratcliffe
oddjob is offline  
Add Post to del.icio.us
Reply With Quote
Old 11-13-2007, 12:57 PM   #183 (permalink)
Contributing Member
 
Join Date: 08-30-07
Location: North Hollywood
Posts: 124
iTrader: 4 / 100%
Latest Blog:
None

k594 is liked by many
ok here u go
Attached Files
File Type: txt log.txt (4.4 KB, 36 views)
k594 is offline  
Add Post to del.icio.us
Reply With Quote
Old 11-14-2007, 03:47 AM   #184 (permalink)
Contributing Member
 
oddjob's Avatar
 
Join Date: 10-25-06
Location: London, U.K.
Posts: 106
iTrader: 0 / 0%
Latest Blog:
None

oddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the rough
Well done. Your java has updated successfully and the log is now free of malware.

HOWEVER ... I keep asking you to tell me what trouble you are having with the computer. if any, and you never reply. I can guess the answer but, like a doctor, I would like to know the symptoms from you.

>> Please tell me if anything is still wrong in any way.


As to firewalls this is my list of approved ones you can choose from ....

Zone Alarm > http://www.zonelabs.com/store/conten...=en&lid=nav_za

Sygate > http://www.simtel.net/product.php%5B...D%5Dsimtel.net

Sunbelt Firewall (formerly Kerio) > http://www.sunbelt-software.com/Home...onal-Firewall/

Comodo > http://www.comodo.com/products/free_products.html

Jetico > http://www.jetico.com/index.htm#/jpfirewall.htm

PC Tools Firewall Plus 2.0 > http://www.pctools.com/firewall/download/


Remember to download, install and register the replacement firewall BEFORE you deactivate the Windoze firewall.


OJ
__________________
“A computer lets you make more mistakes faster than any other invention with the possible exceptions of handguns and Tequilla” Mitch Ratcliffe
oddjob is offline  
Add Post to del.icio.us
Reply With Quote
Old 11-14-2007, 08:25 AM   #185 (permalink)
Contributing Member
 
Join Date: 08-30-07
Location: North Hollywood
Posts: 124
iTrader: 4 / 100%
Latest Blog:
None

k594 is liked by many
well after all the cleanup the comp is running smoothly

no more problems at this time
thank you very much for your help
k594 is offline  
Add Post to del.icio.us
Reply With Quote
Old 11-14-2007, 08:33 AM   #186 (permalink)
Contributing Member
 
oddjob's Avatar
 
Join Date: 10-25-06
Location: London, U.K.
Posts: 106
iTrader: 0 / 0%
Latest Blog:
None

oddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the rough
No problem. Glad I could help.

Remember …. HJT doesn't see all malware. Far from it. You must keep a watch on your computer and report any unusual happenings.

If you are certain you have no more trouble you should clear out all old System Restore points then immediately create a new one so you have something to fall back on should anything go awry again. Also remember to make SR points on a regular basis.

(Maybe bookmark these links)

More on System Restore ...

http://www.microsoft.com/windowsxp/u...w_03may19.mspx


What may have lead up to your infection and help keep your computer free of malware …

http://www.castlecops.com/t7736-So_h...rst_place.html

http://www.help2go.com/Tutorials/Pro...Hijackers.html

http://www.techsupportforum.com/secu...do-i-need.html

There is a little duplication/crossover but all these tutorials are well worth reading.

Make sure you only ever have ONE antivirus and ONE firewall in operation at any time and also make sure they are kept fully up to date.

Don’t forget to keep AVG Anti Spyware / Superantispyware updated and use it to scan/disinfect your computer from time to time.


If you do suffer an infection again you should run first Ccleaner to clean out your system.


Also run through this before posting another HijackThis log …

http://www.help2go.com/Tutorials/Pro...Hijackers.html


Safe surfing.


OJ
__________________
“A computer lets you make more mistakes faster than any other invention with the possible exceptions of handguns and Tequilla” Mitch Ratcliffe
oddjob is offline  
Add Post to del.icio.us
Reply With Quote
Old 12-13-2007, 02:20 AM   #187 (permalink)
Contributing Member
 
Fivetide's Avatar
 
Join Date: 11-22-07
Location: Preston
Posts: 71
iTrader: 0 / 0%
Latest Blog:
None

Fivetide is liked by many
Great forums guys I've only just had a look around outside the SEO. Part of my job is application installation's creations mostly MSI's MST's etc , I always wanted to get around to building a HJT log analyiser.. need to get/find some time I think it would be helpful.
__________________
Prestons Buisness and Social Directory
Preston Links

The War Directory Project
wardirectory
Fivetide is offline  
Add Post to del.icio.us
Reply With Quote
Old 12-13-2007, 04:53 AM   #188 (permalink)
Contributing Member
 
oddjob's Avatar
 
Join Date: 10-25-06
Location: London, U.K.
Posts: 106
iTrader: 0 / 0%
Latest Blog:
None

oddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the rough
Quote:
Originally Posted by Fivetide View Post
I always wanted to get around to building a HJT log analyiser.. need to get/find some time I think it would be helpful.
In all my years of fixing people's computers from malware I have tried the various online analysers already around but they don't always help that much.

There is one at hjt.de which seems to be most popular ......

http://www.hijackthis.de/en

...and another ....

http://hjt.networktechs.com/


Both seem to list everything but can easily misguide users into deleting something vital to their system.

The prime site for downloading the latest version of HJT is Trend Micro ...

http://www.trendsecure.com/portal/en...kthis/download

Once the app. has been installed and run TM suggest you send it to their online analyser for more advice. Again, the results lead to the possibility of misleading users into deleting something critical.

The best analyser I know of is at Help2Go ...

http://www.help2go.com/component/detective/

This one splits the results into two sections ... the HJT entries definitely to remove and this flagged a "suspisious". For those doubtful entries H2G recommend posting the log into the spyware forum for specific personal guidance on what to do next.


Hope this helps your researches.


OJ
__________________
“A computer lets you make more mistakes faster than any other invention with the possible exceptions of handguns and Tequilla” Mitch Ratcliffe
oddjob is offline  
Add Post to del.icio.us
Reply With Quote
Old 12-13-2007, 08:55 AM   #189 (permalink)
Contributing Member
 
Fivetide's Avatar
 
Join Date: 11-22-07
Location: Preston
Posts: 71
iTrader: 0 / 0%
Latest Blog:
None

Fivetide is liked by many
Thanks for that Oddjob i was thinking more of an exclustion list rather than inclution but as you say its hard to do something that all level of IT people can use. Also It would have to be an online one as I always worry that some ones going to repackage the program and add stuff to it that is as bad as the thing you are trying to get rid of.
__________________
Prestons Buisness and Social Directory
Preston Links

The War Directory Project
wardirectory
Fivetide is offline  
Add Post to del.icio.us
Reply With Quote
Old 12-25-2007, 12:22 PM   #190 (permalink)
Junior Member
 
Join Date: 12-04-06
Posts: 3
iTrader: 0 / 0%
Latest Blog:
None

DrVenkman is liked by many
Back for some more help with my PC. Not experiencing any notable problems as of now, but would like to ensure a clean bill of health for my PC. Any help would be appreciated as always.
Attached Files
File Type: txt hijackthis1.txt (8.6 KB, 36 views)
DrVenkman is offline  
Add Post to del.icio.us
Reply With Quote
Old 12-27-2007, 03:57 AM   #191 (permalink)
Contributing Member
 
oddjob's Avatar
 
Join Date: 10-25-06
Location: London, U.K.
Posts: 106
iTrader: 0 / 0%
Latest Blog:
None

oddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the rough
Quote:
Originally Posted by DrVenkman View Post
Back for some more help with my PC. Not experiencing any notable problems as of now, but would like to ensure a clean bill of health for my PC. Any help would be appreciated as always.
The log is free of malware but your java is WAY out of date.

Older versions have vulnerabilities that malware can use to infect your system.

Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 6 to your desktop from here ……
    http://javadl.sun.com/webapps/downlo...BundleId=12798
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check/tick any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then install the newest version by double-clicking the update file you just downloaded to your desktop.


OJ
__________________
“A computer lets you make more mistakes faster than any other invention with the possible exceptions of handguns and Tequilla” Mitch Ratcliffe
oddjob is offline  
Add Post to del.icio.us
Reply With Quote
Old 03-05-2008, 11:51 PM   #192 (permalink)
Junior Member
 
Join Date: 04-22-07
Location: In your mind
Posts: 23
iTrader: 0 / 0%
Latest Blog:
None

Cool_xxx is liked by many
Code:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
D:\Program Files\PC Auto Shutdown\ShutdownService.exe
D:\WINDOWS\system32\slserv.exe
D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
D:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
D:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Babylon\Babylon-Pro\Babylon.exe
D:\Program Files\PC Auto Shutdown\AutoShutdown.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Internet Download Manager\IDMan.exe
D:\Program Files\Rapidown\rapidown.exe
D:\WINDOWS\system32\imapi.exe
D:\Program Files\Internet Download Manager\IEMonitor.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Internet Explorer\IEXPLORE.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://register.mobicom.net/registration.php?imei=351153000189110
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - D:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O1 - Hosts: 127.0.0.22 mcafee.com
O1 - Hosts: 127.0.0.22 www.mcafee.com
O1 - Hosts: 127.0.0.22 mcafee.net
O1 - Hosts: 127.0.0.22 www.mcafee.net
O1 - Hosts: 127.0.0.22 mcafee.org
O1 - Hosts: 127.0.0.22 www.mcafee.org
O1 - Hosts: 127.0.0.22 mcafeesecurity.com
O1 - Hosts: 127.0.0.22 www.mcafeesecurity.com
O1 - Hosts: 127.0.0.22 mcafeesecurity.net
O1 - Hosts: 127.0.0.22 www.mcafeesecurity.net
O1 - Hosts: 127.0.0.22 mcafeesecurity.org
O1 - Hosts: 127.0.0.22 www.mcafeesecurity.org
O1 - Hosts: 127.0.0.22 mcafeeb2b.com
O1 - Hosts: 127.0.0.22 www.mcafeeb2b.com
O1 - Hosts: 127.0.0.22 mcafeeb2b.net
O1 - Hosts: 127.0.0.22 www.mcafeeb2b.net
O1 - Hosts: 127.0.0.22 mcafeeb2b.org
O1 - Hosts: 127.0.0.22 www.mcafeeb2b.org
O1 - Hosts: 127.0.0.22 nai.com
O1 - Hosts: 127.0.0.22 www.nai.com
O1 - Hosts: 127.0.0.22 nai.net
O1 - Hosts: 127.0.0.22 www.nai.net
O1 - Hosts: 127.0.0.22 nai.org
O1 - Hosts: 127.0.0.22 www.nai.org
O1 - Hosts: 127.0.0.22 vil.nai.com
O1 - Hosts: 127.0.0.22 www.vil.nai.com
O1 - Hosts: 127.0.0.22 vil.nai.net
O1 - Hosts: 127.0.0.22 www.vil.nai.net
O1 - Hosts: 127.0.0.22 vil.nai.org
O1 - Hosts: 127.0.0.22 www.vil.nai.org
O1 - Hosts: 127.0.0.22 grisoft.com
O1 - Hosts: 127.0.0.22 www.grisoft.com
O1 - Hosts: 127.0.0.22 grisoft.net
O1 - Hosts: 127.0.0.22 www.grisoft.net
O1 - Hosts: 127.0.0.22 grisoft.org
O1 - Hosts: 127.0.0.22 www.grisoft.org
O1 - Hosts: 127.0.0.22 kaspersky-labs.com
O1 - Hosts: 127.0.0.22 www.kaspersky-labs.com
O1 - Hosts: 127.0.0.22 kaspersky-labs.net
O1 - Hosts: 127.0.0.22 www.kaspersky-labs.net
O1 - Hosts: 127.0.0.22 kaspersky-labs.org
O1 - Hosts: 127.0.0.22 www.kaspersky-labs.org
O1 - Hosts: 127.0.0.22 kaspersky.com
O1 - Hosts: 127.0.0.22 www.kaspersky.com
O1 - Hosts: 127.0.0.22 kaspersky.net
O1 - Hosts: 127.0.0.22 www.kaspersky.net
O1 - Hosts: 127.0.0.22 kaspersky.org
O1 - Hosts: 127.0.0.22 www.kaspersky.org
O1 - Hosts: 127.0.0.22 downloads1.kaspersky-labs.com
O1 - Hosts: 127.0.0.22 www.downloads1.kaspersky-labs.com
O1 - Hosts: 127.0.0.22 downloads1.kaspersky-labs.net
O1 - Hosts: 127.0.0.22 www.downloads1.kaspersky-labs.net
O1 - Hosts: 127.0.0.22 downloads1.kaspersky-labs.org
O1 - Hosts: 127.0.0.22 www.downloads1.kaspersky-labs.org
O1 - Hosts: 127.0.0.22 downloads2.kaspersky-labs.com
O1 - Hosts: 127.0.0.22 www.downloads2.kaspersky-labs.com
O1 - Hosts: 127.0.0.22 downloads2.kaspersky-labs.net
O1 - Hosts: 127.0.0.22 www.downloads2.kaspersky-labs.net
O1 - Hosts: 127.0.0.22 downloads2.kaspersky-labs.org
O1 - Hosts: 127.0.0.22 www.downloads2.kaspersky-labs.org
O1 - Hosts: 127.0.0.22 downloads3.kaspersky-labs.com
O1 - Hosts: 127.0.0.22 www.downloads3.kaspersky-labs.com
O1 - Hosts: 127.0.0.22 downloads3.kaspersky-labs.net
O1 - Hosts: 127.0.0.22 www.downloads3.kaspersky-labs.net
O1 - Hosts: 127.0.0.22 downloads3.kaspersky-labs.org
O1 - Hosts: 127.0.0.22 www.downloads3.kaspersky-labs.org
O1 - Hosts: 127.0.0.22 downloads4.kaspersky-labs.com
O1 - Hosts: 127.0.0.22 www.downloads4.kaspersky-labs.com
O1 - Hosts: 127.0.0.22 downloads4.kaspersky-labs.net
O1 - Hosts: 127.0.0.22 www.downloads4.kaspersky-labs.net
O1 - Hosts: 127.0.0.22 downloads4.kaspersky-labs.org
O1 - Hosts: 127.0.0.22 www.downloads4.kaspersky-labs.org
O1 - Hosts: 127.0.0.22 download.mcafee.com
O1 - Hosts: 127.0.0.22 www.download.mcafee.com
O1 - Hosts: 127.0.0.22 download.mcafee.net
O1 - Hosts: 127.0.0.22 www.download.mcafee.net
O1 - Hosts: 127.0.0.22 download.mcafee.org
O1 - Hosts: 127.0.0.22 www.download.mcafee.org
O1 - Hosts: 127.0.0.22 norton.com
O1 - Hosts: 127.0.0.22 www.norton.com
O1 - Hosts: 127.0.0.22 norton.net
O1 - Hosts: 127.0.0.22 www.norton.net
O1 - Hosts: 127.0.0.22 norton.org
O1 - Hosts: 127.0.0.22 www.norton.org
O1 - Hosts: 127.0.0.22 symantec.com
O1 - Hosts: 127.0.0.22 www.symantec.com
O1 - Hosts: 127.0.0.22 symantec.net
O1 - Hosts: 127.0.0.22 www.symantec.net
O1 - Hosts: 127.0.0.22 symantec.org
O1 - Hosts: 127.0.0.22 www.symantec.org
O1 - Hosts: 127.0.0.22 liveupdate.symantecliveupdate.com
O1 - Hosts: 127.0.0.22 www.liveupdate.symantecliveupdate.com
O1 - Hosts: 127.0.0.22 liveupdate.symantecliveupdate.net
O1 - Hosts: 127.0.0.22 www.liveupdate.symantecliveupdate.net
O1 - Hosts: 127.0.0.22 liveupdate.symantecliveupdate.org
O1 - Hosts: 127.0.0.22 www.liveupdate.symantecliveupdate.org
O1 - Hosts: 127.0.0.22 liveupdate.symantec.com
O1 - Hosts: 127.0.0.22 www.liveupdate.symantec.com
O1 - Hosts: 127.0.0.22 liveupdate.symantec.net
O1 - Hosts: 127.0.0.22 www.liveupdate.symantec.net
O1 - Hosts: 127.0.0.22 liveupdate.symantec.org
O2 - BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - D:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - D:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - D:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: (no name) - {140BD8E3-C167-11D4-B4A3-080000180323} - (no file)
O2 - BHO: (no name) - {2E9D4C81-9F27-4c14-B804-7B0F6BC88A4F} - D:\Program Files\Outerinfo\Outerinfo.dll (file missing)
O2 - BHO: FGCatchUrl - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - D:\DOCUME~1\Cool\LOCALS~1\Temp\RarSFX1\jccatch.dll (file missing)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - D:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {A6984C00-C6EB-11D4-B4A4-080000180323} - D:\PROGRA~1\Rapidown\rapi310.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - D:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O3 - Toolbar: Babylon - {965B54B0-71E0-4611-8DE7-F73FA0B20E26} - D:\Program Files\Babylon\Babylon Toolbar\BabylonIEToolBar.dll
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [qtije\yspy] rundll32 C:\PROGRA~1\qtije\9V8.dll,init
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "D:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] D:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [win16dll] D:\Program Files\Advanced Invisible Keylogger\Advanced Invisible Keylogger.exe
O4 - HKLM\..\Run: [Babylon Client] D:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [PC Auto Shutdown] "D:\Program Files\PC Auto Shutdown\AutoShutdown.exe"
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [DLD.EXE] D:\Program Files\Download Direct\DLD.exe
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] D:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [IDMan] D:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = D:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: Rapidown.lnk = D:\Program Files\Rapidown\rapidown.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Download All with Rapidshare Downloader - D:\DOCUME~1\Cool\LOCALS~1\Temp\RarSFX1\jc_all.htm
O8 - Extra context menu item: &Download with Rapidshare Downloader - D:\DOCUME~1\Cool\LOCALS~1\Temp\RarSFX1\jc_link.htm
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZKfox000
O8 - Extra context menu item: Add to Anti-Banner - I:\Kaspersky\ie_banner_deny.htm
O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Download all by Rapidown... - D:\Program Files\Rapidown\rapidownGetAll.htm
O8 - Extra context menu item: Download all links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download by Rapidown... - D:\Program Files\Rapidown\rapidownGet.htm
O8 - Extra context menu item: Download FLV video content with IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Translate with &Babylon - res://D:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Rapidown - {57E91B47-F40A-11D1-B792-444553540011} - D:\Program Files\Rapidown\rapidown.exe
O9 - Extra 'Tools' menuitem: Rapidown - {57E91B47-F40A-11D1-B792-444553540011} - D:\Program Files\Rapidown\rapidown.exe
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - D:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - D:\Program Files\Yahoo!\Common\Yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{A422CE7C-5BD2-4C0B-957E-CF743E3FF8B8}: NameServer = 202.126.91.11 202.126.92.6
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - D:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: PCAutoShutdown_Service - GoldSolution Software, Inc. - D:\Program Files\PC Auto Shutdown\ShutdownService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - D:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - D:\WINDOWS\SYSTEM32\slserv.exe
__________________
I love my love and miSSik u
Cool_xxx is offline  
Add Post to del.icio.us
Reply With Quote
Old 03-06-2008, 01:21 AM   #193 (permalink)
Contributing Member
 
oddjob's Avatar
 
Join Date: 10-25-06
Location: London, U.K.
Posts: 106
iTrader: 0 / 0%
Latest Blog:
None

oddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the rough
@Cool_xxx >> the log you have posted is incomplete. Please post a fresh log including ALL the headers.

Also please give us a description of what's wrong with the computer and why you are posting the log.

Thanks.


OJ
__________________
“A computer lets you make more mistakes faster than any other invention with the possible exceptions of handguns and Tequilla” Mitch Ratcliffe
oddjob is offline  
Add Post to del.icio.us
Reply With Quote
Old 03-06-2008, 03:20 AM   #194 (permalink)
Junior Member
 
Join Date: 04-22-07
Location: In your mind
Posts: 23
iTrader: 0 / 0%
Latest Blog:
None

Cool_xxx is liked by many
I don't use any anti virus. So I think that infected
__________________
I love my love and miSSik u
Cool_xxx is offline  
Add Post to del.icio.us
Reply With Quote
Old 03-06-2008, 05:33 AM   #195 (permalink)
Contributing Member
 
oddjob's Avatar
 
Join Date: 10-25-06
Location: London, U.K.
Posts: 106
iTrader: 0 / 0%
Latest Blog:
None

oddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the rough
@Cool_xxx ... yes, you may well be infected if you do not use antivirus.

You should install a good free antivirus like one of these .....

AVG > http://free.grisoft.com/doc/1

Avast > http://www.avast.com/eng/avast_4_home.html

Antivir > http://www.free-av.com/antivirus/allinonen.html

**Comodo > http://www.antivirus.comodo.com/ [AV has been in beta only for many months]


**Footnote >> Comodo also has other free tools such as a firewall and anti spam.


After you have installed antivirus pease post a FULL log with all the headers.


OJ
__________________
“A computer lets you make more mistakes faster than any other invention with the possible exceptions of handguns and Tequilla” Mitch Ratcliffe
oddjob is offline  
Add Post to del.icio.us
Reply With Quote
Old 03-06-2008, 11:03 PM   #196 (permalink)
Junior Member
 
Join Date: 04-22-07
Location: In your mind
Posts: 23
iTrader: 0 / 0%
Latest Blog:
None

Cool_xxx is liked by many
Hey Thanks. But is it 100% free. Can I trust surely? What about kaspersky or bitdefender where I download full version?
__________________
I love my love and miSSik u
Cool_xxx is offline  
Add Post to del.icio.us
Reply With Quote
Old 03-07-2008, 01:50 AM   #197 (permalink)
Contributing Member
 
oddjob's Avatar
 
Join Date: 10-25-06
Location: London, U.K.
Posts: 106
iTrader: 0 / 0%
Latest Blog:
None

oddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the roughoddjob is a jewel in the rough
All the AV programs I listed in post 195 are full versions, free, excellent and reliable. You don't need to pay for a software AV program.

I use AVG free AV.


OJ
__________________
“A computer lets you make more mistakes faster than any other invention with the possible exceptions of handguns and Tequilla” Mitch Ratcliffe
oddjob is offline  
Add Post to del.icio.us
Reply With Quote
Old 03-08-2008, 02:45 AM   #198 (permalink)
Junior Member
 
Join Date: 03-08-08
Posts: 3
iTrader: 0 / 0%
Latest Blog:
None

sport29883 is liked by many
HJT log
Hi. My comp has been really annoying me. AVG says it is infected with worm autorun.f. it cleans it but the computer gets reinfected on startup. Task manager, regedit are all disabled. computer does not shut down but on giving shut down command, only the desktop wallpaper is seen. If I use any USB on it, the USB device gets infected with W32.svich. Not able to get rid of either worms. I have posted the HJT log below. Kindly advise.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:36:27 PM, on 3/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Lenovo\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\SSVICHOSST.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Administrator\Desktop\antivirus\HijackThi s.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
F2 - REG:system.ini: Shell=Explorer.exe SSVICHOSST.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1A7D1F06-E55C-4A9E-94A0-D4B2377A6023} - (no file)
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Yahoo Messengger] C:\WINDOWS\system32\SSVICHOSST.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing)
O21 - SSODL: adsnv - {8F61586C-5D1B-4c76-BB3A-3B88F96A18B0} - C:\WINDOWS\system32\adsnv.dll (file missing)
O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Lenovo\Bluetooth Software\bin\btwdins.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 5959 bytes
sport29883 is offline  
Add Post to del.icio.us
Reply With Quote
Old 03-10-2008, 03:39 AM   #199 (permalink)