#1
Inactive
Profile: Join Date: Oct 2007
Posts: 29
Computer Experience:
[Resolved] Restrictions [popups, etc - HJT log]
shortly ago My dad tried to get Nortan off his computer to get some kind of email program, after his attempt some files were lost, lost admin access to control panel and other files, and every ten minutes a spyware window pop up says my computer is making unautherized copies of a file and requist to launch a spyware program. Does anyone know what this means.
Didn't find the information you thought to find?Similar Threads
#2
Staff
Profile: Join Date: May 2002
Location: Staffordshire, UK
Posts: 21,544
Computer Experience:
crash - Welcome to the Board folder on your hard drive, say C:\HJT - not to the Desktop or a temporary location. When entries are fixed with HJT a backup is made to the folder from which HJT is run and this must be in a permanent location.HJT and double click on hijackthis.exe and select Scan and save a log file - this will be saved in the folder from which you ran HJT . Post the log here (copy/paste into a post)
#3
Inactive
Profile: Join Date: Oct 2007
Posts: 29
Computer Experience:
hijackthis
Logfile of Trend Micro HijackThis v2.0.2SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.bright.net http ://www.bright.net
#4
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Hi crash here or here , saving the file to your desktop.Close all open programs and windows Double click combofix.exe and follow the prompts.
When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
#5
Inactive
Profile: Join Date: Oct 2007
Posts: 29
Computer Experience:
ComboFix 07-10-23.2 - tom 2007-10-27 8:53:01.1 - NTFSx86 HJT http://www.gmer.net
#6
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Please navigate to C:\WINDOWS\Tasks then right click the file Scheduled scanning task.job and select Properties. What is the exact path in the Run: line?contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
http ://www.windowsbbs.com/showthread.php?p=369598#post369598
Collect::[22]
C:\WINDOWS\SYSTEM32\winsflte.dll
C:\WINDOWS\SYSTEM32\cfgmig32.dll
C:\WINDOWS\SYSTEM32\winsflt.dll
C:\WINDOWS\bwUnin-6.3.3.61-7211241L.exe
File::
C:\Docume~1\tom\Start~1\Programs\Startup\system.exe
C:\WINDOWS\SYSTEM32\WinAvXX.exe
C:\WINDOWS\SYSTEM32\printer.exe
Folder::
C:\WINDOWS\rnapxs
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion \Run]
"WinAVX"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion \Run]
"WinAVX"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion \policies\system]
"DisableRegistryTools"=dword:00000000
"DisableTaskMgr"=dword:00000000
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion \policies\system]
"DisableRegistryTools"=dword:00000000
"DisableTaskMgr"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion \policies\explorer]
"NoControlPanel"=dword:00000000
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion \policies\explorer]
"NoControlPanel"=dword:00000000
"NoWindowsUpdate"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Shell"="Explorer.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AltnetPointsManager]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bikini]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CMESys]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ultimate Cleaner]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ultimate Defender]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr] Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and a fresh HijackThis log.Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
#7
Inactive
Profile: Join Date: Oct 2007
Posts: 29
Computer Experience:
run path: C:\PROGRA~1\EMBARQ~2\ANTI-V~1\fsav.exe /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\EMBARQ~2\ANTI-V~1\report.txt HJT http://www.gmer.net
#8
Inactive
Profile: Join Date: Oct 2007
Posts: 29
Computer Experience:
combo sent up a malware report also,SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)HJT \Trend Micro\HijackThis\HijackThis.exehttp://www.bright.net http ://www.bright.net
#9
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Scan again with HijackThis and place a check next to the following entries, then click Fix Checked.contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
File::
C:\WINDOWS\Tasks\Scheduled scanning task.job
Rootkit::
C:\WINDOWS\system32\printer.exe
C:\WINDOWS\system32\WinAvXX.exe
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion \Run]
"WinAVX"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion \Run]
"WinAVX"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion \policies\system]
"DisableRegistryTools"=dword:00000000
"DisableTaskMgr"=dword:00000000
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion \policies\system]
"DisableRegistryTools"=dword:00000000
"DisableTaskMgr"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion \policies\explorer]
"NoControlPanel"=dword:00000000
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion \policies\explorer]
"NoControlPanel"=dword:00000000
"NoWindowsUpdate"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Shell"="Explorer.exe" Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and a fresh HijackThis log.Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
#10
Inactive
Profile: Join Date: Oct 2007
Posts: 29
Computer Experience:
Logfile of Trend Micro HijackThis v2.0.2SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)HJT \Trend Micro\HijackThis\HijackThis.exehttp://www.bright.net http ://www.bright.netHJT http://www.gmer.net
#11
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Scan again with HijackThis and fix the following entries.contents of the quote box below to a blank notepad. Save it to the desktop as;fix.reg All Files (*.*)
Quote:
REGEDIT4CurrentVersion \Run]CurrentVersion \Run]currentversion \policies\system]currentversion \policies\system]currentversion \policies\explorer]currentversion \policies\explorer]
Double click fix.reg and allow it to merge with the registry.Note: You must be logged onto an account with administrator privileges to complete the following. Deckard's System Scanner (dss .exe) to your desktop.Close all applications and windows Double click on dss .exe to run it and follow the prompts.
When the scan is complete, two text files will open; main.txt , which will be maximized and extra.txt , which will be minimized.
#12
Inactive
Profile: Join Date: Oct 2007
Posts: 29
Computer Experience:
could not open the fix. file, computer says i don't have admin rights to register. the dss did work.Percentage of Memory in Use: 78% (more than 75%). Total Physical Memory: 126 MiB (512 MiB recommended). SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)dss .exeHJT \TRENDM~1\HIJACK~1\tom.exehttp://www.bright.net http ://www.bright.netHJT \TRENDM~1\HIJACK~1\backups\) ----------------WAN Miniport (ATW)) - c:\windows\system32\drivers\wanatw4.sys (file missing)HJT ad .doubleclick.netad .fastclick.net
#13
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Please download HostsXpert .Unzip HostsXpert.zip to it's own folder.
Open the folder and double click on HostsXpert.exe
Then click on "Restore Original Hosts " to restore your Hosts file to its default condition.
Click on Make Hosts Read Only to secure it against further infection.
Close program when complete.
Registrar Lite . Highlight and copy the following bolded string, then open RegLite and paste the string in the address window, then click go.HKEY_CURRENT_USER\software\microsoft\windows\currentversion \policies\system Decimal: value from 1 to Zero, then click OK.DisableRegistryTools
#14
Inactive
Profile: Join Date: Oct 2007
Posts: 29
Computer Experience:
Deckard's System Scanner v20071014.68Percentage of Memory in Use: 78% (more than 75%). Total Physical Memory: 126 MiB (512 MiB recommended). SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)dss .exeHJT \TRENDM~1\HIJACK~1\tom.exehttp://www.bright.net http ://www.bright.netHJT
#15
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Looks like RegLite failed to make the changes too. I've put together a batch to try. Please download fix.exe and save it to your desktop. Reboot to safe mode and logon to your account. Double click fix.exe then click Start to extract the contents to it's own folder. Open the folder and double click the fix.bat file to run it. When it's complete, reboot to normal mode and create a new Deckard's log, then post main.txtNote:: This fix was written specifically for this user. It is not for anyone else to use!!
All times are GMT +1. The time now is 04:37 .
