Post Your HijackThis logs here

[slfocus]

Originally Posted by oddjob

Hello slfocus

Sorry but I can see at least one file on your system that indicates you may be using cracked/illegal software. We don't help in such cases.

However, if you remove such program(s) & repost a HJT logfile, we'll see what we can do.

I bought this second hand and I don't know which software exactly is cracked. Could you please be more specific, so I could remove them ASAP.

Thanks Oddjob!

[oddjob]

This entry In your log caught my eye ......

O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll

The presence of Antiwpa indicates someone (perhaps the previous owner) has used a crack key to unlock/pirate Windows programs etc.

Look at this search for more details ......

http://www.google.com/search?rls=GGG...earch&aq=f&oq=


Check to ensure all your programs are genuine then update them all (including a visit to Windows Updates to update the operating system).


Uninstall/remove Antiwpa and kill off the HJT entry thus .....

> open HJT again,
> click "scan",
> put a tick/check mark in the box to the left of that 020 entry,
> close ALL open broswer windows - including this one,
> click on Fix Checked* at the foot of the HJT window.


Once you have done that download/install & scan your computer with MBAM. Follow the instructions I gave to sarabear in post #217 above.


You are using an out of date version of HJT. Download Trend Micro HijackThis 2.0.2 here ……

http://www.trendsecure.com/portal/en...HJTInstall.exe

• Save HJTInstall.exe to your desktop.
• Doubleclick on the HJTInstall.exe icon on your desktop.
• By default it will install to C:\Program Files\Trend Micro\HijackThis .
• Click on Install.
• It will create a HijackThis icon on the desktop.
• Once installed, it will launch Hijackthis.
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
• Click on "Edit > Select All" then click on "Edit > Copy" and Paste the entire contents of the log (no attachments) into your next post.

DO NOT use the ”AnalyseThis” button. Its findings are dangerous if misinterpreted.

DO NOT have Hijackthis fix anything else yet. Most of what HJT lists will be harmless or even required by your Operating System. Someone will guide you on what to do next.


Post a fresh HJT log with an update on how the computer is operating after that.

[slfocus]

Originally Posted by oddjob

This entry In your log caught my eye ......

O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll

The presence of Antiwpa indicates someone (perhaps the previous owner) has used a crack key to unlock/pirate Windows programs etc.

Look at this search for more details ......

http://www.google.com/search?rls=GGG...earch&aq=f&oq=


Check to ensure all your programs are genuine then update them all (including a visit to Windows Updates to update the operating system).


Uninstall/remove Antiwpa and kill off the HJT entry thus .....

> open HJT again,
> click "scan",
> put a tick/check mark in the box to the left of that 020 entry,
> close ALL open broswer windows - including this one,
> click on Fix Checked* at the foot of the HJT window.


Once you have done that download/install & scan your computer with MBAM. Follow the instructions I gave to sarabear in post #217 above.


You are using an out of date version of HJT. Download Trend Micro HijackThis 2.0.2 here ……

http://www.trendsecure.com/portal/en...HJTInstall.exe

• Save HJTInstall.exe to your desktop.
• Doubleclick on the HJTInstall.exe icon on your desktop.
• By default it will install to C:\Program Files\Trend Micro\HijackThis .
• Click on Install.
• It will create a HijackThis icon on the desktop.
• Once installed, it will launch Hijackthis.
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
• Click on "Edit > Select All" then click on "Edit > Copy" and Paste the entire contents of the log (no attachments) into your next post.

DO NOT use the ”AnalyseThis” button. Its findings are dangerous if misinterpreted.

DO NOT have Hijackthis fix anything else yet. Most of what HJT lists will be harmless or even required by your Operating System. Someone will guide you on what to do next.


Post a fresh HJT log with an update on how the computer is operating after that.

Thanks Oddjob!

I'll do as you said and come back with a fresh log file. Thanks again for your help.

slfocus

[antirem]

I remember when hijackthis first came out.. it was a god send.

[slfocus]

Hi,

Can someone please help me with my laptop.
It opens browser windows without even a prompt. log file attached.

thanks a lot

[oddjob]

Hi slfocus

Your log shows you have out of date java and at least one potentially serious infection.

To try and kill off the infection download, install MBAM [free] and scan your computer with it. Let it fix anything bad that it finds.

Get it here ......

http://www.malwarebytes.org/mbam.php


After this you must update your java. Go here to download & install the latest version ......

http://java.sun.com/javase/downloads/index.jsp


Don't forget you must delete old version(s) of java that may still be on your system. Use the Add/Remove Programs facility to do that.


Reboot & use the computer again as normal then report back. If you still have trouble post a fresh HJT log with an update on what problems you still experience.


OJ

[slfocus]

Thannks OJ

I will try it and come back to you.

Regards

[dlbott]

ok, need help here. the stupid antivirusxp pro hijack got me. running zone alarm and usually catches stuff. not sure how it happened but need it back. i ran hijcackthis in safe mode, not sure what to delete. I do not have access to regedit or taskmanager, other than what is in hijackthis.

here are the files. please send answers to dlbott@hughes.net and dlbott@hotmail.com, email is a mess for me. i am waiting so please help.

don

i added the startup and the logfile. also gonna leave this open for messages here.

[dlbott]

wow, well guess no help. was hoping to get someanswers tonight.

any other insomniacs out there i could really use my computer back lol.

thanks

don

[oddjob]

Hi dlbot

Sorry to hear of your troubles.

Assuming you can get online OK, to try and kill off the infection, you should download, install MBAM [free] and scan your computer with it. Let it fix anything bad that it finds.

Get it here ......

http://www.malwarebytes.org/mbam.php

Post back and let us know what happens.


(By the way it's not good for you to post your email addresses in open forum. Many spammers and other troublemakers have bots that crawl the web looking to harvest information like this. If you insist on revealing email addresses make sure you show them in a form unrecognisable to bots such as "dlbottAThughesDOTnet" and tell readers to replace the AT & DOT with the usual symbols. people will know what you mean).

[dlbott]

hey thanks for answering. malware seems to work but then every time it is run again it finds two more, also, i can't seem to edit that post as you suggested for the emails. thanks for that by the way, good advice.

here is what malware found last time ran.

Malwarebytes' Anti-Malware 1.34
Database version: 1853
Windows 5.1.2600 Service Pack 3

3/17/2009 12:56:42 PM
mbam-log-2009-03-17 (12-56-42).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 221775
Time elapsed: 1 hour(s), 21 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


the same two come up every time. are they real or false positive????

thanks

don

[oddjob]

Sounds like you have an infected file there.

Download ComboFix from the location below and save it to your Desktop >>

http://subs.geekstogo.com/ComboFix.exe

Double click combofix.exe and follow the prompts. Never rename Combofix unless instructed.

When finished it shall produce a log for you. Post that log and a HijackThis log in your next reply.

Note: Do not mouseclick Combofix's window while its running. That may cause it to stall.


Carefully examine the log from Combofix. Under the heading "Other Deletions" you will most likely find this statement >>

"Infected copy of c:\windows\system32\userinit.exe was found and disinfected
Restored copy from - c:\windows\$NtServicePackUninstall$\userinit.exe"

IF you see that then go to Start -> Run and type in combofix /u (note the space) & press OK. This will remove Combofix.


Finally update Malwarebytes, run another full scan and post the log here.

[CyberWorldJobs]

Hmm,
can Anyone View Myn,
Not Much Problem But I get a Error Message At Startup Some Regser.exe Not Found Or Something Hope someone can Help,
(note I have Edited The Ip There Where Its Written Lemme Know If Its Required Or Could Be Problem)

[Kyleisthebeast]

Ok, I need help BAD! I have my hjt log attached and I have a LOT of problems with this computer. Including explorer.exe crashes randomly, logonuiX.exe and logonui.exe errors (P.S. logonuiX.exe is a file for logon screen that is on cnet and made by wincustomize, BUT i uninstalled it and I get an error EVERYTIME I start up my PC and I get it 10 times then it takes me this gay looking OLD login screen where I have to replace Compaq_Owner with my login name and then type in my pass) PLEASE Tell me what I need to do! THANKS!

[neoscud]

here's mine...

I just bought my PC and started installing some programs but suddenly my PC has started to act a little bit slow during its startup. Can someone check it please?

Thanks!

[abajan]

When I first tried to run HijackThis (version 1.99.1), I got the warning seen in the 1st attachment. So I shut the browser (Firefox) and ran HJT again. This time I didn’t get the warning.

The results are contained in the 2nd attachment. Is my system running okay or are there files that need deleting?

Thanks.