Author Topic: Virus ? (Read 65506 times)

Dummy · « **Reply #15 on:** December 28, 2005, 05:00:34 PM »

Sorry I forgot to add all I have is the system restore disks HP sent. These are factory disks not my downloads.

Fed · « **Reply #16 on:** December 28, 2005, 05:38:40 PM »

I don't think you can do a clean install with restore disks, I may be wrong, I've never owned any.
Someone? Anyone?

GX1_Man · « **Reply #17 on:** December 28, 2005, 06:02:55 PM »

Depends on the manufacturer and what they were made to do. Not even consistent between manufacturer's (i.e. some Compaqs yes, others no).

J0K3R · « **Reply #18 on:** December 28, 2005, 08:43:38 PM »

Get rid of Nortons,, i'm serious man

Dell4700 · « **Reply #19 on:** December 28, 2005, 10:33:27 PM »

Is the PC still under warranty? Fixing the PC yourself may void some or all of your warranty (not recommended)?

Otherwise, please provide the following information:

- your PC Model Number (HP Pavillion is not enough info)
- your PC hardware/firmware configuration (BIOS, drives, video card, other peripherals, etc.) (new hard drive or old hard drive is not enough info)
- normal current software configuration (common programs, antivirus/anti-malware, firewall, browser, etc.) (Norton is not enough info)
- what was the normal operating configuration when you first purchased the PC? What operating system came with it?
- more background info on what happened or what you think happened. Include any changes you may have made at the time things began going south (new hardware/software, etc.)
- you describe problems while online? Do you have problems when not online?
- what specific programs are you unable to download? What specific web sites give you this problem?

Try to give as much info as you can to avoid guesswork on our part. If you don't understand any of the above or you don't know how to get the info, please let us know and we'll help.

Dell

Dummy · « **Reply #20 on:** December 29, 2005, 12:45:47 PM »

OS Name Microsoft Windows XP Home Edition
Version 5.1.2600 Service Pack 1 Build 2600
OS Manufacturer Microsoft Corporation
System Name YOUR-XHTR8HVC4P
System Manufacturer HP Pavilion 061
System Model DM181A-ABA a305w
System Type X86-based PC
Processor x86 Family 15 Model 2 Stepping 9 GenuineIntel ~2691 Mhz
BIOS Version/Date 3.24, 10/14/2003
SMBIOS Version 2.31
Windows Directory C:\WINDOWS
System Directory C:\WINDOWS\System32
Boot Device \Device\HarddiskVolume1
Hardware Abstraction Layer Version = "5.1.2600.1106 (xpsp1.020828-1920)"
User Name YOUR-XHTR8HVC4P\Owner
Time Zone Central Standard Time
Total Physical Memory 256.00 MB
Available Physical Memory 120.98 MB
Total Virtual Memory 853.33 MB
Available Virtual Memory 628.63 MB
Page File Space 606.35 MB
Page File C:\pagefile.sys
Memory Address 0xA0000-0xBFFFF PCI bus
Memory Address 0xA0000-0xBFFFF Intel(R) 82845G/GL/GE/PE/GV Graphics Controller
Channel 4 Direct memory access controller
Channel 3 ECP Printer Port (LPT1) OK
Channel 2 Standard floppy disk controller

82845G/GL/GE/PE/GV Graphics Controller OK
&REV_10\4&2C53C0AE&0&10F0
Last Reset 1/1/2002 4:24 AM
Index 1
Service Name RTL8139
IP Address 24.176.117.20
IP Subnet 255.255.248.0
Default IP Gateway 24.176.112.1
DHCP Enabled Yes
DHCP Server 68.114.38.178
DHCP Lease Expires 1/3/2002 4:32 AM
DHCP Lease Obtained 1/1/2002 4:32 AM
MAC Address 00:40:2B:69:84:47
I/O Port 0x00002000-0x000020FF
Memory Address 0xE8100000-0xE81000FF
IRQ Channel IRQ 17
Driver c:\windows\system32\drivers\r8139n51.sys (5.505.1004.2002 built by: WinDDK, 45.88 KB (46,976 bytes), 8/23/2003 8:41 AM)

Name [00000002] RAS Async Adapter
Adapter Type Not Available
Installed Yes
PNP Device ID Not Available
Index 2
Name [00000003] Packet Scheduler Miniport
Adapter Type Ethernet 802.3
Product Type Packet Scheduler Miniport
Installed Yes
PNP Device ID ROOT\MS_PSCHEDMP\0000
Last Reset 1/1/2002 4:24 AM
MAC Address 00:40:2B:69:84:47
Driver c:\windows\system32\drivers\psched.sys (5.1.2600.1106 (xpsp1.020828-1920), 64.50 KB (66,048 bytes), 1/1/2002 1:25 AM)

Name [00000004] WAN Miniport (L2TP)
Adapter Type Not Available
Product Type WAN Miniport (L2TP)
Installed Yes
PNP Device ID ROOT\MS_L2TPMINIPORT\0000
Name [00000005] WAN Miniport (PPTP)
Adapter Type Wide Area Network (WAN)
Product Type WAN Miniport (PPTP)
Installed Yes
PNP Device ID ROOT\MS_PPTPMINIPORT\0000
MAC Address 50:50:54:50:30:30
Driver c:\windows\system32\drivers\raspptp.sys (5.1.2600.1106 (xpsp1.020828-1920), 45.25 KB (46,336 bytes), 1/1/2002 1:25 AM)

Name [00000006] WAN Miniport (PPPOE)
Adapter Type Wide Area Network (WAN)
Product Type WAN Miniport (PPPOE)
Installed Yes
PNP Device ID ROOT\MS_PPPOEMINIPORT\0000
MAC Address 33:50:6F:45:30:30
Driver c:\windows\system32\drivers\raspppoe.sys (5.1.2600.0 (xpclient.010817-1148), 38.00 KB (38,912 bytes), 1/1/2002 1:25 AM)

Name [00000007] Direct Parallel
Adapter Type Not Available
Product Type Direct Parallel
Installed Yes
PNP Device ID ROOT\MS_PTIMINIPORT\0000
MAC Address Not Available
Driver c:\windows\system32\drivers\raspti.sys (5.1.2600.0 (xpclient.010817-1148), 16.13 KB (16,512 bytes), 1/1/2002 1:25 AM)

Name [00000008] WAN Miniport (IP)
Adapter Type Not Available
Product Type WAN Miniport (IP)
Installed Yes
PNP Device ID ROOT\MS_NDISWANIP\0000
Last Reset 1/1/2002 4:24 AM
Index 8
Service Name NdisWan
Driver c:\windows\system32\drivers\ndiswan.sys (5.1.2600.1106 (xpsp1.020828-1920), 85.50 KB (87,552 bytes), 1/1/2002 1:25 AM)

Name [00000009] Packet Scheduler Miniport
Adapter Type Ethernet 802.3
Product Type Packet Scheduler Miniport
Installed Yes
PNP Device ID ROOT\MS_PSCHEDMP\0001
MAC Address DA:DA:20:52:41:53
Driver c:\windows\system32\drivers\psched.sys (5.1.2600.1106 (xpsp1.020828-1920), 64.50 KB (66,048 bytes), 1/1/2002 1:25 AM)
Driver c:\windows\system32\drivers\serial.sys (5.1.2600.1106 (xpsp1.020828-1920), 61.00 KB (62,464 bytes), 1/1/2002 1:25 AM)
[Parallel]
Name LPT1
PNP Device ID ACPI\PNP0401\1
I/O Port 0x00000378-0x0000037F
I/O Port 0x00000778-0x0000077F
DMA Channel Channel 3
Driver c:\windows\system32\drivers\parport.sys (5.1.2600.1106 (xpsp1.020828-1920), 74.25 KB (76,032 bytes), 8/29/2002 3:27 AM)
[Drives]
Item Value
Drive A:
Description 3 1/2 Inch Floppy Drive
Drive C:
Description Local Fixed Disk
Compressed No
File System NTFS
Size 31.70 GB (34,039,107,584 bytes)
Free Space 27.70 GB (29,747,302,400 bytes)
Volume Name HP_PAVILION
Volume Serial Number B43FDB55
Drive E:
Description CD-ROM Disc
[Disks]
Item Value
Description Disk drive
Manufacturer (Standard disk drives)
Model ST340015A
Bytes/Sector 512
Media Loaded Yes
Media Type Fixed hard disk
Partitions 1
SCSI Bus 0
SCSI Logical Unit 0
SCSI Port 0
SCSI Target ID 0
Sectors/Track 63
Size 37.27 GB (40,015,503,360 bytes)
Total Cylinders 5,169
Total Sectors 78,155,280
Total Tracks 1,240,560
Tracks/Cylinder 240
Partition Disk #0, Partition #0
Partition Size 31.70 GB (34,039,111,680 bytes)
Partition Starting Offset 5,968,650,240 bytes
Item Value
Name Intel(r) 82801DB Ultra ATA Storage Controller-24CB
Manufacturer Intel

Dummy · « **Reply #21 on:** December 29, 2005, 01:06:36 PM »

Hope this helps
The problem started months ago but I wasn't aware of it until recently. I'm almost positive I opened an e-mail attachment that started the problem. I am working on a Biogas project which some people wanted to invest in, and of course this. I do however have a nicely forged cashiers check for $9,800. No, I didnt lose any money

Since I started nocticing some e-mail I sent several times did not go through I started browsing in my computer and 1) I don't know much 2) I knew it was'nt right. I called HP am they sent a new hard drive, I installed it but nothing really changed. Countless phone calls later they told me if I could access the internet "Good Luck". I started looking in dos and noticed several drivers and programs there. When I did a system recovery normally everything is new, however now when I do a recovery when I go to start it shows alot of new programs installed (highlited).

dl65 · « **Reply #22 on:** December 29, 2005, 01:15:27 PM »

Dummy ....How about running a scan with hijackthis and posting it here ....it may reveal something ......
http://www.majorgeeks.com/download3155.html
After you run the scan .....save it to your desktop ......and then copy it and then paste it into the Compter Hope thread that you have going ........if its too large to get it in one post ........post it in 2 or more . Be sure to post the entire log including the info on your system and the running processes .

dl65

Dummy · « **Reply #23 on:** December 29, 2005, 01:41:53 PM »

Logfile of HijackThis v1.99.1
Scan saved at 6:52:56 AM, on 1/1/2002
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\ps2.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us9.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://us9.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us9.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-us9.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-us9.hpwis.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://us9.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://msn.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file)
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

PLEASE NOTE THE TIME AND DATE ARE INCORRECT
I DID NOT RESET TIME OR DATE WHEN I PULLED THE BATTERY ON BIOS

Dummy · « **Reply #24 on:** December 29, 2005, 01:59:34 PM »

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Owner>cd..

C:\Documents and Settings>cd..

C:\>dir /a
Volume in drive C is HP_PAVILION
Volume Serial Number is B43F-DB55

Directory of C:\

08/23/2003 06:53 AM 0 AUTOEXEC.BAT
01/01/2002 03:09 AM 196 BOOT.BAK
01/01/2002 04:28 AM 266 boot.ini
01/01/2002 03:18 AM <DIR> cmdcons
08/29/2002 06:00 AM 245,920 cmldr
01/01/2002 04:13 AM <DIR> Config.Msi
08/23/2003 06:53 AM 0 CONFIG.SYS
08/23/2003 06:56 AM <DIR> Documents and Settings
01/01/2002 04:24 AM 259,047,424 hiberfil.sys
01/01/2002 03:58 AM <DIR> hp
01/01/2002 03:26 AM <DIR> I386
08/23/2003 06:53 AM 0 IO.SYS
08/23/2003 06:53 AM 0 MSDOS.SYS
08/29/2002 06:00 AM 47,580 NTDETECT.COM
08/29/2002 06:00 AM 233,632 ntldr
01/01/2002 04:24 AM 390,070,272 pagefile.sys
01/01/2002 06:46 AM <DIR> Program Files
01/01/2002 03:19 AM <DIR> RECYCLER
01/01/2002 03:14 AM <DIR> System Volume Information
08/23/2003 07:11 AM <DIR> system.sav
01/01/2002 04:13 AM <DIR> WINDOWS
11 File(s) 649,645,290 bytes
10 Dir(s) 29,745,631,232 bytes free

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Owner>cd..

C:\Documents and Settings>cd..

C:\>MEM /D

Address Name Size Type
------- -------- ------ ------
000000 000400 Interrupt Vector
000400 000100 ROM Communication Area
000500 000200 DOS Communication Area

000700 IO 000370 System Data
CON System Device Driver
AUX System Device Driver
PRN System Device Driver
CLOCK$ System Device Driver
COM1 System Device Driver
LPT1 System Device Driver
LPT2 System Device Driver
LPT3 System Device Driver
COM2 System Device Driver
COM3 System Device Driver
COM4 System Device Driver

000A70 MSDOS 001630 System Data

0020A0 IO 001FF0 System Data
KBD 000CE0 System Program
HIMEM 0004E0 DEVICE=
XMSXXXX0 Installed Device Driver
000490 FILES=
000090 FCBS=
0000E0 LASTDRIVE=
0007D0 STACKS=
0040A0 COMMAND 000A20 Program
004AD0 MSDOS 000070 -- Free --
004B50 COMMAND 000440 Environment
004FA0 MEM 000380 Environment
005330 MEM 0174E0 Program
01C820 MSDOS 0837C0 -- Free --
09FFF0 SYSTEM 02C000 System Program

0CC000 MSDOS 000360 -- Free --
0CC370 MSCDEXNT 0001D0 Program
0CC550 REDIR 000A70 Program
0CCFD0 DOSX 0087A0 Program
0D5780 DOSX 000080 Data
0D5810 MSDOS 00E7D0 -- Free --
0E3FF0 SYSTEM 001000 System Program

0E5000 IO 003100 System Data
MOUSE 0030F0 System Program
0E8110 MSDOS 007EE0 -- Free --
This is my MS DOS INFORMATION

dl65 · « **Reply #25 on:** December 29, 2005, 02:08:12 PM »

Dummy.... ok ......here's what I'm seeing .......
For some reason you do not have the latest M/S updates installed .....and in particular SP2 ......... Is there some reason you havent upgraded to SP2 ?
Before you start ....turn off the system restore feature of XP.
Now open up hijackthis and run the scan ......when its done ...go down to the lower right corner and click on CONFIG ..... then when the new window opens ....Down in the 4 boxes that have the Default page URLS ........change them all to http://www.msn.com ( in all 4 places ) ...now click BACK ( lower right corner)

Now then in your hijack log mark for removal the following :

All R1 and R0 entries

O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - (no file)

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

Then click FIX CHECKED ......

When its finished ....reboot and see how things are .......
then rerun hijackthis again and let's have a look at it .

dl65

Dummy · « **Reply #26 on:** December 29, 2005, 02:32:16 PM »

C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\system32\ps2.exe
C:\Program Files\Hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AutoTKit] C:\hp\bin\AUTOTKIT.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

To answer the question service pack 2 only reason is until I get off the "network" it really does no good. 1) All of the things get changed back to whatever "they" want
I have a service pack 2 disk from Microsoft and downloaded all the updates yesterday, last night I had to do another system restore in order to get back on the internet. Now I click explorer until I see the "green bar" then turn my modem on till I get a response then turn it off while I post to keep some acess to the net. I had downloaded the Hijack this and saved it to disk otherwise I probally would not beem able to get it.

dl65 · « **Reply #27 on:** December 29, 2005, 02:54:15 PM »

Dummy.... Are you still connecting to the net on that odd net work ?

Do you have msn messenger installed by any chance ?
I ask because if you ask for remote assistance , I may be able to clear up your issue .

dl65

Dummy · « **Reply #28 on:** December 29, 2005, 03:01:24 PM »

As far as I know yes

dl65 · « **Reply #29 on:** December 29, 2005, 03:06:03 PM »

Dummy.....

Quote

As far as I know yes

is that the response to the network or msn messenger ?

dl65

Computer Hope Forum

News:

Author Topic: Virus ? (Read 65506 times)

Dummy

Re: Virus ?

Fed

Re: Virus ?

GX1_Man

Re: Virus ?

J0K3R

Re: Virus ?

Dell4700

Re: Virus ?

Dummy

Re: Virus ?

Dummy

Re: Virus ?

dl65

Re: Virus ?

Dummy

Re: Virus ?

Dummy

Re: Virus ?

dl65

Re: Virus ?

Dummy

Re: Virus ?

dl65

Re: Virus ?

Dummy

Re: Virus ?

dl65

Re: Virus ?