#1
Senior Member
Profile: Join Date: Nov 2006
Location: Halifax,NS Canada
Posts: 174
Computer Experience:
maybe another virus
hi Tom,SP2 (WinNT 5.01.2600)HJT \HijackThis.exehttp://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR http://www.cbc.ca/ns/ http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR https://blrscr3.egs-seg.gc.ca/applet...applet-epf.cab http://go.microsoft.com/fwlink/?LinkID=39204 http://update.microsoft.com/windowsu...?1142097753734 http://zone.msn.com/bingame/chnz/def...jolauncher.cab http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab http://zone.msn.com/bingame/popcaploader_v10.cab http://support.intel.com/design/moth...id/BoardID.cab
Didn't find the information you thought to find?Similar Threads
#2
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Hi Dana,Note: You must be logged onto an account with administrator privileges to complete the following. Deckard's System Scanner (dss .exe) to your desktop.dss .exe to run it and follow the prompts.main.txt , which will be maximized and extra.txt , which will be minimized.
#3
Senior Member
Profile: Join Date: Nov 2006
Location: Halifax,NS Canada
Posts: 174
Computer Experience:
No good
Hi Dave, Tried to download tool and my anti-virus picks up "W32/Trojan.BGRF" . The download won't complete and says cannot copy file. So far, haven't been able to accomplish anything. PS Lsass.exe comes up and says "System error -object file not found" My previous thread was inaccurate. Anyways, a little concerned with the Trojan thing.
#4
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
The tool is safe. It's a false positive by the anti virus app. Can you disable it long enough to download and run the tool?
#5
Senior Member
Profile: Join Date: Nov 2006
Location: Halifax,NS Canada
Posts: 174
Computer Experience:
DSS Log
Hi Dave, Log as requested.Total Physical Memory: 502 MiB (512 MiB recommended). SP2 (WinNT 5.01.2600)dss .exeHJT \Owner.exehttp://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR http://sympatico.msn.ca/default.aspx http://g.msn.com/0SEENUS/SAOS01?FORM=TOOLBR https://blrscr3.egs-seg.gc.ca/applet...applet-epf.cab http://go.microsoft.com/fwlink/?LinkID=39204 http://update.microsoft.com/windowsu...?1142097753734 http://zone.msn.com/bingame/chnz/def...jolauncher.cab http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab http://zone.msn.com/bingame/popcaploader_v10.cab http://support.intel.com/design/moth...id/BoardID.cab HJT \backups\) ----------------------------------http://dinet.info/n/us14/n.cab http://download.bitdefender.com/reso...an8/oscan8.cab PCI Ethernet Adapter NT Driver) - c:\windows\system32\drivers\rtl8029.sys (file missing)Ad -Aware SE Personal.job
#6
Senior Member
Profile: Join Date: Nov 2006
Location: Halifax,NS Canada
Posts: 174
Computer Experience:
Spybot log
I only have two files for the spybot log and neither show the spyware that was removed. Sorry.
#7
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
I do see a few signs of Zlob yet, and there may be others that we can't see, so let's run another tool.SmitfraudFix by S!Ri, saving the file to your desktop. Follow the directions on that page to run option 2 in safe mode. When done, boot back into normal mode and create a new HijackThis log. Post the new HijackThis log and the SmitfraudFix log, C:\rapport.txt
#8
Senior Member
Profile: Join Date: Nov 2006
Location: Halifax,NS Canada
Posts: 174
Computer Experience:
Smit Fraud
Log as requested.DNS DNS Server Search Order: 192.168.2.1DNS Server Search Order: 192.168.2.1
#9
Senior Member
Profile: Join Date: Nov 2006
Location: Halifax,NS Canada
Posts: 174
Computer Experience:
New HJT Log
Logfile of HijackThis v1.99.1SP2 (WinNT 5.01.2600)HJT \HijackThis.exehttps://blrscr3.egs-seg.gc.ca/applet...applet-epf.cab http://go.microsoft.com/fwlink/?LinkID=39204 http://update.microsoft.com/windowsu...?1142097753734 http://zone.msn.com/bingame/chnz/def...jolauncher.cab http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab http://zone.msn.com/bingame/popcaploader_v10.cab http://support.intel.com/design/moth...id/BoardID.cab
#10
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
You ran SmitfraudFix in normal mode rather than safe mode. I can't determine if was as effective as it could have been. Recommend you run it again in safe mode, then post the rapport.txt log.
#11
Senior Member
Profile: Join Date: Nov 2006
Location: Halifax,NS Canada
Posts: 174
Computer Experience:
New Smitfraudfix
Ooops! OK Here's a new one (run in safe mode)DNS
#12
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Thanks.
#13
Senior Member
Profile: Join Date: Nov 2006
Location: Halifax,NS Canada
Posts: 174
Computer Experience:
SmitFraud Option 5
SmitFraudFix v2.171DNS Before FixDNS Server Search Order: 192.168.2.1DNS Server Search Order: 192.168.2.1DNS After FixDNS Server Search Order: 192.168.2.1DNS Server Search Order: 192.168.2.1
#14
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Looks good. I'm quite sure those 208.67.220.220 dhcp addresses were put there by Spybot. Looks like you're clean, but I'd recommend running an online virus scan just to be sure we haven't missed anything.HERE Once you are on the Panda site click the Scan your PC now button
A new window will open...click the Check Now button
Enter your Country
Enter your State/Province
Enter your e-mail address and click send
Select either Home User or Company
Select the appropriate Yes or No to receiving marketing information
Click the Free Online Scan button
If it wants to install an ActiveX component allow it
It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
When download is complete, click on My Computer to start the scan
When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
HJT log.
#15
Senior Member
Profile: Join Date: Nov 2006
Location: Halifax,NS Canada
Posts: 174
Computer Experience:
Activescan Reports
Two reports - one from maybe a week ago, the second just finished.SP2 (WinNT 5.01.2600)HJT \HijackThis.exehttps://blrscr3.egs-seg.gc.ca/applet...applet-epf.cab http://zone.msn.com/binFrameWork/v10...I.cab55579.cab http://go.microsoft.com/fwlink/?LinkID=39204 http://zone.msn.com/BinFrameWork/v10...y.cab55579.cab http://zone.msn.com/binframework/v10...t.cab55579.cab http://update.microsoft.com/windowsu...?1142097753734 http://zone.msn.com/bingame/chnz/def...jolauncher.cab http://zone.msn.com/bingame/zpagames...f.cab55579.cab http://acs.pandasoftware.com/actives...ree/asinst.cab http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab http://zone.msn.com/binframework/v10...y.cab55579.cab http://zone.msn.com/bingame/popcaploader_v10.cab http://support.intel.com/design/moth...id/BoardID.cab
All times are GMT +1. The time now is 10:07 .
