 |
 |
|
|||||||
| Register | FAQ | Members List | Calendar | Search | Today's Posts | Mark Forums Read |
| Computers & Internet For all those computer related discussions. |
 |
 |
|
|
LinkBack | Thread Tools | Display Modes |
11-13-2007, 11:12 AM
|
#182 (permalink) |
|
Contributing Member
 
|
You still have Trojan trouble there.
Update all three programs to their latest definitions, scan your computer with them again and let them fix what they can. Now open HJT again ... click on 'Do a System Scan Only'... put tick/check marks next to these entries IF still present ... O4 - HKLM\..\RunOnce: [1] C:\WINDOWS\system32\cmd.exe /c erase "C:\DOCUME~1\H\LOCALS~1\Temp\AcsUninstall.exe" O4 - HKLM\..\RunOnce: [2] C:\WINDOWS\system32\cmd.exe /c erase "C:\DOCUME~1\H\LOCALS~1\Temp\AcsUninstallRes.d ll" O4 - HKLM\..\RunOnce: [3] C:\WINDOWS\system32\cmd.exe /c erase "C:\DOCUME~1\H\LOCALS~1\Temp\shfolder.dll" Remember to close ALL open browser windows – including this one – before clicking on “Fix Checked” at the foot of the HijackThis window. ******************* Empty your recycle bin again (Ccleaner should have already done it twice). ******************* Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
Post a fresh HJT log AND AN UPDATE ON WHAT ISSUES YOU STILL HAVE WITH THE COMPUTER. OJ
__________________
“A computer lets you make more mistakes faster than any other invention with the possible exceptions of handguns and Tequilla” Mitch Ratcliffe |
|
 
|
|
11-14-2007, 03:47 AM
|
#184 (permalink) |
|
Contributing Member
|
Well done. Your java has updated successfully and the log is now free of malware.
HOWEVER ... I keep asking you to tell me what trouble you are having with the computer. if any, and you never reply. I can guess the answer but, like a doctor, I would like to know the symptoms from you. >> Please tell me if anything is still wrong in any way. As to firewalls this is my list of approved ones you can choose from .... Zone Alarm > http://www.zonelabs.com/store/conten...=en&lid=nav_za Sygate > http://www.simtel.net/product.php%5B...D%5Dsimtel.net Sunbelt Firewall (formerly Kerio) > http://www.sunbelt-software.com/Home...onal-Firewall/ Comodo > http://www.comodo.com/products/free_products.html Jetico > http://www.jetico.com/index.htm#/jpfirewall.htm PC Tools Firewall Plus 2.0 > http://www.pctools.com/firewall/download/ Remember to download, install and register the replacement firewall BEFORE you deactivate the Windoze firewall. OJ
__________________
“A computer lets you make more mistakes faster than any other invention with the possible exceptions of handguns and Tequilla” Mitch Ratcliffe |
|
|
|
|
11-14-2007, 08:33 AM
|
#186 (permalink) |
|
Contributing Member
|
No problem. Glad I could help.
Remember …. HJT doesn't see all malware. Far from it. You must keep a watch on your computer and report any unusual happenings. If you are certain you have no more trouble you should clear out all old System Restore points then immediately create a new one so you have something to fall back on should anything go awry again. Also remember to make SR points on a regular basis. (Maybe bookmark these links) More on System Restore ... http://www.microsoft.com/windowsxp/u...w_03may19.mspx What may have lead up to your infection and help keep your computer free of malware … http://www.castlecops.com/t7736-So_h...rst_place.html http://www.help2go.com/Tutorials/Pro...Hijackers.html http://www.techsupportforum.com/secu...do-i-need.html There is a little duplication/crossover but all these tutorials are well worth reading. Make sure you only ever have ONE antivirus and ONE firewall in operation at any time and also make sure they are kept fully up to date. Don’t forget to keep AVG Anti Spyware / Superantispyware updated and use it to scan/disinfect your computer from time to time. If you do suffer an infection again you should run first Ccleaner to clean out your system. Also run through this before posting another HijackThis log … http://www.help2go.com/Tutorials/Pro...Hijackers.html Safe surfing.  OJ
__________________
“A computer lets you make more mistakes faster than any other invention with the possible exceptions of handguns and Tequilla” Mitch Ratcliffe |
|
|
|
|
12-13-2007, 02:20 AM
|
#187 (permalink) |
|
Contributing Member
 
|
Great forums guys I've only just had a look around outside the SEO. Part of my job is application installation's creations mostly MSI's MST's etc , I always wanted to get around to building a HJT log analyiser.. need to get/find some time I think it would be helpful.
__________________
Prestons Buisness and Social Directory Preston Links The War Directory Project wardirectory |
|
|
|
|
12-13-2007, 04:53 AM
|
#188 (permalink) | |
|
Contributing Member
|
Quote:
There is one at hjt.de which seems to be most popular ...... http://www.hijackthis.de/en ...and another .... http://hjt.networktechs.com/ Both seem to list everything but can easily misguide users into deleting something vital to their system. The prime site for downloading the latest version of HJT is Trend Micro ... http://www.trendsecure.com/portal/en...kthis/download Once the app. has been installed and run TM suggest you send it to their online analyser for more advice. Again, the results lead to the possibility of misleading users into deleting something critical. The best analyser I know of is at Help2Go ... http://www.help2go.com/component/detective/ This one splits the results into two sections ... the HJT entries definitely to remove and this flagged a "suspisious". For those doubtful entries H2G recommend posting the log into the spyware forum for specific personal guidance on what to do next. Hope this helps your researches. OJ
__________________
“A computer lets you make more mistakes faster than any other invention with the possible exceptions of handguns and Tequilla” Mitch Ratcliffe |
|
|
|
|
|
12-13-2007, 08:55 AM
|
#189 (permalink) |
|
Contributing Member
|
Thanks for that Oddjob i was thinking more of an exclustion list rather than inclution but as you say its hard to do something that all level of IT people can use. Also It would have to be an online one as I always worry that some ones going to repackage the program and add stuff to it that is as bad as the thing you are trying to get rid of.
__________________
Prestons Buisness and Social Directory Preston Links The War Directory Project wardirectory |
|
|
|
|
12-27-2007, 03:57 AM
|
#191 (permalink) | |
|
Contributing Member
|
Quote:
Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
OJ
__________________
“A computer lets you make more mistakes faster than any other invention with the possible exceptions of handguns and Tequilla” Mitch Ratcliffe |
|
|
|
|
|
03-05-2008, 11:51 PM
|
#192 (permalink) |
|
Member
 |
Code:
__________________
I love my love and miSSik u |
|
|
|
|
03-06-2008, 01:21 AM
|
#193 (permalink) |
|
Contributing Member
|
@Cool_xxx >> the log you have posted is incomplete. Please post a fresh log including ALL the headers.
Also please give us a description of what's wrong with the computer and why you are posting the log. Thanks. OJ
__________________
“A computer lets you make more mistakes faster than any other invention with the possible exceptions of handguns and Tequilla” Mitch Ratcliffe |
|
|
|
|
03-06-2008, 05:33 AM
|
#195 (permalink) |
|
Contributing Member
|
@Cool_xxx ... yes, you may well be infected if you do not use antivirus.
You should install a good free antivirus like one of these ..... AVG > http://free.grisoft.com/doc/1 Avast > http://www.avast.com/eng/avast_4_home.html Antivir > http://www.free-av.com/antivirus/allinonen.html **Comodo > http://www.antivirus.comodo.com/ [AV has been in beta only for many months] **Footnote >> Comodo also has other free tools such as a firewall and anti spam. After you have installed antivirus pease post a FULL log with all the headers. OJ
__________________
“A computer lets you make more mistakes faster than any other invention with the possible exceptions of handguns and Tequilla” Mitch Ratcliffe |
|
|
|
|
03-07-2008, 01:50 AM
|
#197 (permalink) |
|
Contributing Member
|
All the AV programs I listed in post 195 are full versions, free, excellent and reliable. You don't need to pay for a software AV program.
I use AVG free AV. OJ
__________________
“A computer lets you make more mistakes faster than any other invention with the possible exceptions of handguns and Tequilla” Mitch Ratcliffe |
|
|
|
|
03-08-2008, 02:45 AM
|
#198 (permalink) |
|
Junior Member
 |
HJT log
Hi. My comp has been really annoying me. AVG says it is infected with worm autorun.f. it cleans it but the computer gets reinfected on startup. Task manager, regedit are all disabled. computer does not shut down but on giving shut down command, only the desktop wallpaper is seen. If I use any USB on it, the USB device gets infected with W32.svich. Not able to get rid of either worms. I have posted the HJT log below. Kindly advise.
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:36:27 PM, on 3/8/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\Program Files\Lenovo\Bluetooth Software\bin\btwdins.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\SSVICHOSST.exe C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Documents and Settings\Administrator\Desktop\antivirus\HijackThi s.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank F2 - REG:system.ini: Shell=Explorer.exe SSVICHOSST.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1A7D1F06-E55C-4A9E-94A0-D4B2377A6023} - (no file) O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Yahoo Messengger] C:\WINDOWS\system32\SSVICHOSST.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - Winlogon Notify: ACNotify - ACNotify.dll (file missing) O21 - SSODL: adsnv - {8F61586C-5D1B-4c76-BB3A-3B88F96A18B0} - C:\WINDOWS\system32\adsnv.dll (file missing) O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Lenovo\Bluetooth Software\bin\btwdins.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 5959 bytes |
|
|
|
|
03-10-2008, 03:39 AM
|