Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

« previous next »
Pages: [1] 2  All   Go Down

Author Topic: your computer has been infected!  (Read 5729 times)

0 Members and 1 Guest are viewing this topic.

megadeth666

  • Guest
your computer has been infected!
« on: January 28, 2006, 12:13:30 PM »
so ive got a pop up in my system tray that says yor computer has been infected!... it installed a bunch of spyware removers and more malware. i got most of it out but i cant seem to find this one... any help
?


thanks
Logged

GX1_Man

  • Guest
Re: your computer has been infected!
« Reply #1 on: January 28, 2006, 12:22:29 PM »
Logged

megadeth666

  • Guest
Re: your computer has been infected!
« Reply #2 on: January 28, 2006, 12:39:28 PM »
ive used
adaware
spydoctor(using now to stop others)
windows malicious software remover
spyhunter
spybot search and destroy
malware remover
security task manager
ewido
Logged

GX1_Man

  • Guest
Re: your computer has been infected!
« Reply #3 on: January 28, 2006, 12:46:52 PM »
Download and run HijackThis and post the complete logfile here (It may take several posts to get it all) and someone brilliant (dl65 or Fed)  will be along to assist shortly, I'm sure.
« Last Edit: January 28, 2006, 12:55:09 PM by GX1_Man »
Logged

megadeth666

  • Guest
Re: your computer has been infected!
« Reply #4 on: January 28, 2006, 12:53:32 PM »
Logfile of HijackThis v1.99.1
Scan saved at 12:51:25 PM, on 28/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Spyware Doctor\sdhelp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\kmw_run.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Spyware Doctor\swdoctor.exe
C:\WINDOWS\system32\KMW_SHOW.EXE
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\PROGRA~1\NETSCAPE\NETSCAPE\NETSCP.EXE
C:\hijakc this\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.calgarytransit.com/cgi-bin/sched_index"); (C:\Documents and Settings\nick\Application Data\Mozilla\Profiles\default\v7ielj4u.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\nick\Application Data\Mozilla\Profiles\default\v7ielj4u.slt\prefs.js)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [kmw_run.exe] kmw_run.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -onlytray
O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HpMmKbd] HpMmKbd.exe
O4 - HKLM\..\RunOnce: [InnoSetupRegFile.0000000001] "C:\WINDOWS\is-LSSKP.exe" /REG
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [PowerBar] "C:\Program Files\CyberLink DVD Solution\Multimedia Launcher\PowerBar.exe" /AtBootTime
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [SP2 Connection Patcher] "C:\Program Files\SP2 Connection Patcher\SP2ConnPatcher.exe" -n=200
O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Download all by Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download by Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Download selected by Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download web site by Free Download Manager - file://C:\Program Files\Free Download Manager\dlpage.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open using &Advanced JPEG Compressor - C:\Program Files\Advanced JPEG Compressor\ajcieex.htm
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1115367233046
Logged

megadeth666

  • Guest
Re: your computer has been infected!
« Reply #5 on: January 28, 2006, 12:53:48 PM »
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MD Simple Burner Service (NetMDSB) - Sony Corporation - C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe

Logged

dl65

  • R.I.P.


    • Prodigy

    Thanked: 18
    Re: your computer has been infected!
    « Reply #6 on: January 28, 2006, 01:32:33 PM »
     megadeth666......  The entry below is the only thing that I see ....that should be removed .....
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll (file missing)


    Can you tell us ....what was installed ............ by this intruder ?


    dl65  ::)



    Logged
    If you don't know the answer, it isn't a dumb question.

    dl65

    • R.I.P.


      • Prodigy

      Thanked: 18
      Re: your computer has been infected!
      « Reply #7 on: January 28, 2006, 01:37:46 PM »
      megadeth666.......  Did you run AVG and Spybot from the safe mode ? and did you turn off your system restore or is it still on ?


      dl65  ::)

        
      Logged
      If you don't know the answer, it isn't a dumb question.

      megadeth666

      • Guest
      Re: your computer has been infected!
      « Reply #8 on: January 28, 2006, 01:49:02 PM »
      my computer hasnt been able to start in safe mode for a couplt months it sits at the screen with all the comands and stays there... it takes windows atleast 8 mins to even load to my login screen
      .. my system restore is still on
      and avg didnt find anything.
      unless i left the computer trying to get into safe mode for 10 mins..?
      Logged

      GX1_Man

      • Guest
      Re: your computer has been infected!
      « Reply #9 on: January 28, 2006, 02:24:45 PM »
      Have you got a legal Windows CD if (when) you need  to reinstall?  :-?
      « Last Edit: January 28, 2006, 02:25:13 PM by GX1_Man »
      Logged

      megadeth666

      • Guest
      Re: your computer has been infected!
      « Reply #10 on: January 28, 2006, 02:38:37 PM »
      its for a laptop but yes
      Logged

      megadeth666

      • Guest
      Re: your computer has been infected!
      « Reply #11 on: January 28, 2006, 02:39:38 PM »
      and what was installed was ...
      spywarestrike 2.5....
      Logged

      GX1_Man

      • Guest
      Re: your computer has been infected!
      « Reply #12 on: January 28, 2006, 02:53:42 PM »
      SpywareStrike is HORRIBLE and worse than anything it might possibly remove.

      Once it's installed, most anti-spyware software won't be able to remove it. Wade through these detailed
      instructions on removing it manually, from a page at 2-spyware.com, and let me know if this does it for you:

      http://www.2-spyware.com/remove-spywarestrike.html
      Logged

      megadeth666

      • Guest
      Re: your computer has been infected!
      « Reply #13 on: January 28, 2006, 03:25:48 PM »
      HKEY_LOCAL_MACHINE\SOFTWARE\Licenses\{0A4AF3E9A644EE5C8}
      HKEY_LOCAL_MACHINE\SOFTWARE\Licenses\{IA4AF3E9A644EE5C8}
      HKEY_LOCAL_MACHINE\SOFTWARE\Licenses\{K7C0DB872A3F777C0}


      those were the only ones in my registry
      Logged

      megadeth666

      • Guest
      Re: your computer has been infected!
      « Reply #14 on: January 28, 2006, 03:39:04 PM »
      those were the only things that i found and its still not gone....
      Logged
      Pages: [1] 2  All   Go Up
      « previous next »