#1
Inactive
Profile: Join Date: Feb 2005
Location: California
Posts: 46
Computer Experience:
Sluggish Computer with PopUps
My log file is below: Thanks!SP1 (6.00.2600.0000)HJT \HijackThis.exehttp://www.mozilla.org/unix/customizing.html#prefs http://www.mozilla.org/unix/customizing.html#prefs http://files.db3nf.com/scripts/ie.htm http://files.db3nf.com/scripts/ie-e.htm http://housecall60.trendmicro.com/housecall/xscan60.cab https://ctx.jmfamily.com/Citrix/ICAW...a32/wficac.cab http://www.icannnews.com/app/ST/ActiveX.ocx http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab http://www.linksysfix.com/netcheck/2...l/gtdownls.cab http://performancetrac.jmfefinancial...ivexviewer.cab
Didn't find the information you thought to find?Similar Threads
#2
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
You have a baddie there.Click on scanner
Click on Complete System Scan and the scan will begin.
NOTE: During some scans with ewido it is finding cases of false positives.You will need to step through the process of cleaning files one-by-one.
If ewido detects a file you KNOW to be legitimate, select none as the action.
DO NOT select "Perform action on all infections "If you are unsure of any entry found select none for now.
Once the scan has completed, there will be a button located on the bottom of the screen named Save report
Click Save report .
Save the report .txt file to your desktop.
Panda ActiveScan and save the report. Post back with a new HijackThis log, Ewido log and ActiveScan report.
#3
Inactive
Profile: Join Date: Feb 2005
Location: California
Posts: 46
Computer Experience:
Ewido Scan report
ewido security suite - Scan reportHJT \backups\backup-20050706-154533-858.dll -> Heuristic.Win32.Hijacker1 : Cleaned with backup
#4
Inactive
Profile: Join Date: Feb 2005
Location: California
Posts: 46
Computer Experience:
Panda Active Scan Rreport
Incident Status Location Cas \Client\casmf.dll Cas \Client\casclient.exe Cas \Client\Uninstall.exe HJT \backups\backup-20050706-154534-168.dll
#5
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Several things to do here, so we'll take it one thing at a time. http://www.downloads.subratam.org/l2mfix.exe l2mfix.exe . Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread. Please post a new HijackThis log as well.IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder unless you are asked to do so!
#6
Inactive
Profile: Join Date: Feb 2005
Location: California
Posts: 46
Computer Experience:
LM2MFIX Log
L2MFIX find log 1.03FTP Folders Webview"FTP Neighborhood"
#7
Inactive
Profile: Join Date: Feb 2005
Location: California
Posts: 46
Computer Experience:
HJT Log
Logfile of HijackThis v1.99.1SP1 (6.00.2600.0000)HJT \HijackThis.exehttp://www.mozilla.org/unix/customizing.html#prefs http://www.mozilla.org/unix/customizing.html#prefs http://files.db3nf.com/scripts/ie.htm http://files.db3nf.com/scripts/ie-e.htm http://housecall60.trendmicro.com/housecall/xscan60.cab https://ctx.jmfamily.com/Citrix/ICAW...a32/wficac.cab http://www.icannnews.com/app/ST/ActiveX.ocx http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab http://www.pandasoftware.com/activescan/as5/asinst.cab http://www.linksysfix.com/netcheck/2...l/gtdownls.cab http://performancetrac.jmfefinancial...ivexviewer.cab
#8
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Great!
#9
Inactive
Profile: Join Date: Feb 2005
Location: California
Posts: 46
Computer Experience:
L2Mfix 1.03ahttp://www.heysoft.de )http://www.heysoft.de )http://www.heysoft.de )Craig.Peacock@beyondlogic.org Craig.Peacock@beyondlogic.org http://www.heysoft.de )http://www.heysoft.de )
#10
Inactive
Profile: Join Date: Feb 2005
Location: California
Posts: 46
Computer Experience:
New HJT Log
Logfile of HijackThis v1.99.1SP1 (6.00.2600.0000)HJT \HijackThis.exehttp://www.mozilla.org/unix/customizing.html#prefs http://www.mozilla.org/unix/customizing.html#prefs http://files.db3nf.com/scripts/ie.htm http://files.db3nf.com/scripts/ie-e.htm http://housecall60.trendmicro.com/housecall/xscan60.cab https://ctx.jmfamily.com/Citrix/ICAW...a32/wficac.cab http://www.icannnews.com/app/ST/ActiveX.ocx http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab http://www.pandasoftware.com/activescan/as5/asinst.cab http://www.linksysfix.com/netcheck/2...l/gtdownls.cab http://performancetrac.jmfefinancial...ivexviewer.cab
#11
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Fix this line with HJT .
Quote:
attrib -r -s -h C:\WINDOWS\SYSTEM32\dhfgskw.dll Cas \*.*Cas \*.*Cas
Copy the contents of the code box below to a blank notepad. Make sure the formatting remains the same.
Code:
REGEDIT4
[-HKLM\SOFTWARE\Altnet\Dashboard\Messages]
[-HKLM\SOFTWARE\Altnet\Dashboard]
[-HKLM\SOFTWARE\Altnet] Copy the following command to text and save as AltExp.txt regedit /e c:\Altnet.txt "HKEY_LOCAL_MACHINE\SOFTWARE\Altnet" HJT log and the Panda report, as well as the contents of Altnet.txt file located in C:
#12
Inactive
Profile: Join Date: Feb 2005
Location: California
Posts: 46
Computer Experience:
New Logs
Windows Registry Editor Version 5.00SP1 (6.00.2600.0000)HJT \HijackThis.exehttp://www.mozilla.org/unix/customizing.html#prefs http://www.mozilla.org/unix/customizing.html#prefs http://files.db3nf.com/scripts/ie.htm http://files.db3nf.com/scripts/ie-e.htm http://housecall60.trendmicro.com/housecall/xscan60.cab https://ctx.jmfamily.com/Citrix/ICAW...a32/wficac.cab http://www.icannnews.com/app/ST/ActiveX.ocx http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab http://www.pandasoftware.com/activescan/as5/asinst.cab http://www.linksysfix.com/netcheck/2...l/gtdownls.cab http://performancetrac.jmfefinancial...ivexviewer.cab Cas \Client\casmf.dll Cas \Client\casclient.exe Cas \Client\Uninstall.exe HJT \backups\backup-20050706-154534-168.dll
#13
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Your log looks good, but it appears you posted the first ActiveScan report. Please delete and run ActiveScan again, then post the report.
#14
Inactive
Profile: Join Date: Feb 2005
Location: California
Posts: 46
Computer Experience:
Editing Registry
Yes, I am ok with editing registry. I will post new active scan with next post.
#15
Inactive
Profile: Join Date: Feb 2005
Location: California
Posts: 46
Computer Experience:
New Panda ActiveScan
Here is my new Panda ActiveScan. I comfortable editing registry. Thanks for the help!HJT \backups\backup-20050706-154534-168.dll
Last edited by iujmheb; 18th July 2005 at 20:22 .
Reason: Forgot to attach Panda Scan
All times are GMT +1. The time now is 03:10 .
