Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: HiJack This analyse please  (Read 10966 times)

0 Members and 1 Guest are viewing this topic.

patio

  • Moderator


  • Genius
  • Maud' Dib
  • Thanked: 1769
    • Yes
  • Experience: Beginner
  • OS: Windows 7
Re: HiJack This analyse please
« Reply #30 on: March 20, 2009, 04:41:02 PM »
Look into what Windows Repair actually does. It deletes and recreates the system files.

No it doesn't.
If you could tell it to do this selectively you would have 20 % of Gate's wealth right now...
Think about it...
" Anyone who goes to a psychiatrist should have his head examined. "

evilfantasy

  • Malware Removal Specialist


  • Genius
  • Calm like a bomb
  • Thanked: 493
  • Experience: Experienced
  • OS: Windows 11
Re: HiJack This analyse please
« Reply #31 on: March 20, 2009, 04:42:57 PM »

If you could tell it to do this selectively you would have 20 % of Gate's wealth right now...
Think about it...

Right. It rebuilds "broken" files.

FearKiller



    Rookie

    Re: HiJack This analyse please
    « Reply #32 on: March 20, 2009, 04:54:32 PM »
    Right. It rebuilds "broken" files.

    Ok then I have a question for you. How come is it that if you perform a Windows Repair on an XP SP3 machine with an XP SP2 disc, it will revert the machine back to Windows XP SP2? Are the SP3 files broken?

    acschier

      Topic Starter


      Rookie

      Re: HiJack This analyse please
      « Reply #33 on: March 20, 2009, 05:00:12 PM »
      Are any of you guys even 100% sure this is a virut???

      evilfantasy

      • Malware Removal Specialist


      • Genius
      • Calm like a bomb
      • Thanked: 493
      • Experience: Experienced
      • OS: Windows 11
      Re: HiJack This analyse please
      « Reply #34 on: March 20, 2009, 05:12:50 PM »
      Ok then I have a question for you. How come is it that if you perform a Windows Repair on an XP SP3 machine with an XP SP2 disc, it will revert the machine back to Windows XP SP2? Are the SP3 files broken?

      From what I've seen you can't. You have to uninstall SP3 in order to use an SP2 disk.

      Are any of you guys even 100% sure this is a virut???

      I wouldn't say it if I was unsure.

      Take this entry in your HJT log for examlple.

      Quote
      O4 - HKLM\..\Run: [jsf8uiw3jnjgffght] C:\WINDOWS\TEMP\winlogn.exe

      The infection has taken your winlogn.exe and injected itself into it, put it in a new location and no telling what all else. There are probably a few more copies of it elsewhere. It will be the same for all of your important and non-important files.

      If you want to get really technical then see here: Under the Hood: Virut.


      acschier

        Topic Starter


        Rookie

        Re: HiJack This analyse please
        « Reply #35 on: March 20, 2009, 05:43:38 PM »
        just wondering because my computer is back up to its original speed and runs fine except for the wireless LAN adapter...

        FearKiller



          Rookie

          Re: HiJack This analyse please
          « Reply #36 on: March 20, 2009, 05:45:36 PM »
          Quote from: evilfantasy
          From what I've seen you can't. You have to uninstall SP3 in order to use an SP2 disk.

          No. You can. I've done it and it does exactly what I said. Reverts SP3 to SP2.

          An SP1 disc on an SP2 machine is a different story though.

          just wondering because my computer is back up to its original speed and runs fine except for the wireless LAN adapter...

          Try reinstalling the drivers. You should be able to download them from another computer at the manufacturer web site.

          evilfantasy

          • Malware Removal Specialist


          • Genius
          • Calm like a bomb
          • Thanked: 493
          • Experience: Experienced
          • OS: Windows 11
          Re: HiJack This analyse please
          « Reply #37 on: March 20, 2009, 05:46:21 PM »
          Give it a few days. You will likely be back where you started once the infection spreads.

          Run this.

          Download DrWeb CureIt & save it to your desktop. Scan with DrWeb-CureIt as follows:

          • Double-click on drweb-cureit.exe and then click Start
          • An information notice will appear, click OK.
          • This starts a short scan that will scan the files currently running in memory.
          • If you get a prompt to buy the full version just exit out of the window. The scanner will still work without buying the full version
          • If or when something is found, click the Yes button when it asks you if you want to cure it.
          .
          • Once the short scan has finished, Click Settings > Change Settings
          • Under the Scanning tab UNcheck Heuristic analysis and click OK
          • Back at the main window, select the Complete scan button and then click the Green Arrow Start Scanning button on the right and the scan will start.
          • Click Yes to all if it asks if you want to cure/move any file(s).
          • When the scan is done.
          • In the Dr.Web CureIt menu on top left, click File and choose Save report list.
          • Save the DrWeb.csv report to your Desktop.
          • Exit Dr.Web Cureit.
          • Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
          .
          * After reboot, Right-click the Dr.Web log on the desktop and choose Open With > Notepad
          * Copy and paste that log in the next reply

          patio

          • Moderator


          • Genius
          • Maud' Dib
          • Thanked: 1769
            • Yes
          • Experience: Beginner
          • OS: Windows 7
          Re: HiJack This analyse please
          « Reply #38 on: March 20, 2009, 06:42:54 PM »
          Quote
          Ok then I have a question for you. How come is it that if you perform a Windows Repair on an XP SP3 machine with an XP SP2 disc, it will revert the machine back to Windows XP SP2? Are the SP3 files broken?

          Quote
          No. You can. I've done it and it does exactly what I said. Reverts SP3 to SP2.

          This is pure garbage...XP will NOT allow the above to happen...i don't care how many times you say you have done it.

          Your skills are now under a microscope and any additional advice will be looked at closely...
          " Anyone who goes to a psychiatrist should have his head examined. "

          evilfantasy

          • Malware Removal Specialist


          • Genius
          • Calm like a bomb
          • Thanked: 493
          • Experience: Experienced
          • OS: Windows 11
          Re: HiJack This analyse please
          « Reply #39 on: March 20, 2009, 06:50:16 PM »

          FearKiller



            Rookie

            Re: HiJack This analyse please
            « Reply #40 on: March 20, 2009, 06:55:58 PM »
            This is pure garbage...XP will NOT allow the above to happen...i don't care how many times you say you have done it.

            Your skills are now under a microscope and any additional advice will be looked at closely...

            This will be my last post here. Please delete my account. I work for IT and have done the Windows Repair many times. You honestly just said my own eyes have lied to me.

            patio

            • Moderator


            • Genius
            • Maud' Dib
            • Thanked: 1769
              • Yes
            • Experience: Beginner
            • OS: Windows 7
            Re: HiJack This analyse please
            « Reply #41 on: March 20, 2009, 07:09:25 PM »
            It was not meant to be offensive by any means...
            A lot of people work in IT.
            Windows XP if doing a Repair install detects what level SP is installed...
            If the SP does not match the CD being used it will not continue.
            Simple as that.

            You are free to delete your account if you feel that's neccessary...me personally i don't think it is but it's entirely up to you.
            " Anyone who goes to a psychiatrist should have his head examined. "

            FearKiller



              Rookie

              Re: HiJack This analyse please
              « Reply #42 on: March 20, 2009, 10:47:50 PM »
              It was not meant to be offensive by any means...
              A lot of people work in IT.
              Windows XP if doing a Repair install detects what level SP is installed...
              If the SP does not match the CD being used it will not continue.
              Simple as that.

              You are free to delete your account if you feel that's neccessary...me personally i don't think it is but it's entirely up to you.

              We aren't on the same page. I'll explain my procedure.

              1. Insert a Windows XP SP2 disk into a Windows XP SP3 machine.
              2. Boot the computer to the CD drive.
              3. First option asks if you want to set up Windows XP, enter recovery console, or exit. Press "Enter" to proceed with setting up Windows XP.
              4. F8 at the license agreement.
              5. Now I believe this is the point where it searches for previously installed versions of Windows XP. It should find the Windows XP SP3 install on the hard drive.
              6. It then asks if you want to run a repair install on this installation or continue to install a fresh copy of Windows XP.
              7. Select the option for running the repair install.
              8. The repair install begins. You'll see down at the bottom right it says deleting files then it will say copying files.
              9. It will then restart and finish off its repair. About 30-40 minutes.
              10. Eventually you'll get back to the desktop. If you right click "My Computer" and select "Properties" you'll see that it should say "Windows XP SP2."
              11. Go to update Windows and it will request you install SP3.

              If you don't believe me just try it yourself. This isn't something I just looked up online or heard from somebody. My very hands inserted the disk, my very fingers clicked the mouse, and my very eyes saw an XP SP3 machine revert to an XP SP2 machine by doing a repair install.

              Back on topic. There are several anti-malware programs you can run for free. Some I've used are.

              SUPER AntiSpyware
              Malwarebytes
              SDFix
              A-Squared
              Spybot - S&D
              Dr. Web
              F-Secure Online Virus Scanner

              I know some of these have already been mentioned. Now that I actually have the time to write a detailed response. I'll explain what I would do in this situation.

              First thing is to disable System Restore to wipe out any infected restore points. Once that is taken care of, delete all the temp files you can find. Some viruses like to hide in the "Temporary Internet Files" and "Temp" folders located under "Local Settings" in every user profile. Next, is to run Ccleaner. Both the file and registry cleanup. Hit the machine with SUPER AntiSpyware or Malwarebytes. Then SDFix in Safe Mode.
              You can try some of the others I listed above too. Follow this with the Windows repair install if you still have problems that would appear to be fixed by the repair. From this point, without really knowing what will happen in the end, I can't really give any further advice.

              The Windows complete reinstall may be the only way. Don't try spending days to fix when you can reinstall Windows in about an hour or so. If you do reinstall, take precautions to make sure you don't get infected again. Why reinstall Windows only to have it get infected a month later. It doesn't make any sense.

              My recommendations for malware prevention are:

              1. Create your own "Admin" account and your "User" account. Leaving the "User" account with limited rights.
              2. Add strong passwords to the "Admin" as well as the built in "Administrator" account.
              3. Install Spybot and Spywareblaster and use there immunize features.
              4. Use Firefox as your primary browser. If you don't want to, at least set IE to delete temp files when browser is closed and to block third party cookies.
              5. Stay up to date with all Windows updates and other software updates.
              6. Install your favorite friendly anti-virus program.

              Do all that and use the limited user account for daily tasks and I dare you to get a virus that will warrant a Windows reinstall.

              evilfantasy

              • Malware Removal Specialist


              • Genius
              • Calm like a bomb
              • Thanked: 493
              • Experience: Experienced
              • OS: Windows 11
              Re: HiJack This analyse please
              « Reply #43 on: March 20, 2009, 10:57:25 PM »
              Not all malware is created equal. Virut is one that wasn't meant for anything but destruction. The code is so buggy that there is no other logical conclusion. See here http://www.teamfurry.com/wordpress/2007/02/15/under-the-hood-virut/

              For cleaning, we usually have users work our Malware Removal Guide and post the logs so we can be sure that everything is actually gone. I do this with most of my spare time and don't ever turn a request down once I reply to it. This is a case where I just know better. I've tried.

              Once complete you get my final suggestions which include Keeping Yourself Safe On The Web.

              Look at the Computer viruses and spyware forum. We help many users through some tough malware fixes.

              evilfantasy

              • Malware Removal Specialist


              • Genius
              • Calm like a bomb
              • Thanked: 493
              • Experience: Experienced
              • OS: Windows 11
              Re: HiJack This analyse please
              « Reply #44 on: March 20, 2009, 11:08:57 PM »