Malware and Virus RemovalProblems removing malware/viruses? Get help from our Malware removal experts.
Mission Statement
WindowsBBS is an online community dedicated to easily accessible technical support for those using Microsoft operating systems and other Windows software.
Our goal is to become the leading resource for computer users that require assistance with their day-to-day computer usage, including full support for networking PC's, virus & malware removal, system upgrades and general support questions.
Malware has hijacked my account, no admin rights, can't install or run scans
My account on my WIn XP machine has been hijacked and I have lost admin rights. I can't even change the time on the system or connect to my wireless router ThinkPad T42. I followed the previous threads where similar hijacks have been resolved, but the process fails pretty early on as I can't even install the software without admin rights. I tried to run the 2 online scans, but they failed to execute. I moved on to Spybot and AdAware but couldn't install the former on the machine without admin rights. I had an old copy of AdAware that I was able to use. In addition I had an old installation of HJT and SmitFraud from a couple months previous, so I re-ran what I could but got a lot of access denied errors.
I have the AdAware and HJT logs to post, but they don't fit in single posting window.
Didn't find the information you thought to find? Check out these Similar Threads
AdAware Log Summary (Header cuz the whole thing won't fit)
Ad-Aware 2007 Build
Log File Created on: 2007-11-14 00:27:01
Using Definitions File: C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware 2007\core.aawdef
Computer name: DAVIDGEBALA
Name of user performing scan: SYSTEM
System information
===========================
Number of processors: 1
Processor type: Intel(R) Pentium(R) M processor 1.80GHz
Memory Available: 58%
Total Physical Memory: 2146287616 Bytes
Available Physical Memory: 1243394048 Bytes
Total Page File Size: 3600109568 Bytes
Available On Page File: 2903429120 Bytes
Total Virtual Memory: 2147352576 Bytes
Available Virtual Memory: 1989066752 Bytes
OS: Microsoft Windows XP Service Pack 2 (Build 2600)
Ad-Aware 2007 Settings
===========================
Skipping files larger than 1048576 kB
Ignoring infections with lower TAI than: 3
Extended Ad-Aware 2007 Settings
===========================
Unloading known modules during scan
Ignoring spanned files when scanning cab archives
Scanning registry for all users
Using permanent archive caching
Reanalyzing results after scanning before displaying results
Trying to unload modules prior to removal
Let Windows remove files currently in use at next reboot
Removing quarantined objects after restore
Logging Ad-Aware events
Blocking Pop-Ups aggressively
Deactivating Ad-Watch during scans
Writeprotecting system files after repairs
Including Ad-aware command line parameters in log file
Include info about ignored objects in log file
Including basic settings in log file
Including advanced settings in log file
Including user and computer name in log file
Include reference summary in log file
Creating log file for removal operations
Including module info in log file
Include Alternate Data Stream details in log file
Create and save WebUpdate log file
Databaseinfo
===========================
Version number: 33
Build Number: 0
Build Date and Time: 2007/11/11 23:22:48
Scan Statistics
===========================
Method: Full
Scan tracking cookies.............................: On
Scan ADS filestreams..............................: Off
Infections Found
===========================
Family Id: 725 Name: Tracking Cookie Category: DataMiner TAI:3
Item Id: 600000263 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat mediaplex.com svid /
Item Id: 600000263 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat mediaplex.com mojo1 /
Item Id: 600000126 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat hitbox.com CTG /
Item Id: 600000126 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat hitbox.com WSS_GW /
Item Id: 600000212 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat msnportal.112.2o7.net s_vi /
Item Id: 600000144 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat doubleclick.net id /
Item Id: 600000179 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat atdmt.com AA002 /
Item Id: 600000050 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat tribalfusion.com ANON_ID /
Item Id: 600000212 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat 2o7.net s_vi_x7Fx7Cx7Eebxxkx60cnmx60 /
Item Id: 600000555 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat insightexpressai.com IXAIBanners792 /
Item Id: 600000555 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat insightexpressai.com lastInviteTime /
Item Id: 600000555 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat insightexpressai.com IXAIinvited792 /
Item Id: 600000555 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat insightexpressai.com IXAIBannerCounter22623 /
Item Id: 600000555 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat insightexpressai.com IXAIFirstHit792 /
Item Id: 600000555 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat insightexpressai.com IXAILastHit792 /
Item Id: 600000555 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat insightexpressai.com IXAICampaignCounter792 /
Item Id: 600000555 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat insightexpressai.com IXAIBanners780 /
Item Id: 600000555 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat insightexpressai.com IXAIBannerCounter21593 /
Item Id: 600000555 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat insightexpressai.com IXAIinvited780 /
Item Id: 600000555 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat insightexpressai.com IXAIBannerCounter21594 /
Item Id: 600000126 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat ehg-dig.hitbox.com DM51031542SZV6 /
Item Id: 600000126 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat ehg-dig.hitbox.com DM5103083LCAV6 /
Item Id: 600000126 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat ehg-dig.hitbox.com DM56042677CEV6 /
Item Id: 600000460 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat ad.yieldmanager.com uid /
Item Id: 600000460 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat ad.yieldmanager.com vuday1 /
Item Id: 600000460 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat ad.yieldmanager.com ih /
Item Id: 600000460 Value: Browser: Internet Explorer Cookie: C:\Documents and Settings\dgebala\Cookies\index.dat ad.yieldmanager.com fl_inst /
Family Id: 9999 Name: MRU Object Category: MRU Object TAI:0
Item Id: 1 Value: MRU Path: C:\Documents and Settings\dgebala\Recent Count: 57
Item Id: 2 Value: MRU Registry Key: S-1-5-21-310203456-1607214880-635260049-2406\Software\Microsoft\Search Assistant\ACMru\5603 Count: 2
Item Id: 3 Value: MRU Registry Key: S-1-5-21-310203456-1607214880-635260049-2406\Software\Microsoft\Internet Explorer\TypedURLs Count: 6
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:35:43 AM, on 11/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Did you try running Deckard's System Scanner? It does normally require an admin rights account to run, but may run anyway. Instructions follow, just in case.
Still denied. Can't run dss.exe as my account no longer has admin rights
Hi noahdfear, I really appreciate the assistance. I wasn't able to run dss.exe, so I tried to run HJT as a renamed .exe as you suggested. I am posting it here. Not sure what to look for, so I am posting it blindly hoping you can narrow in on the problem! Thanks in advance.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:50:56 PM, on 11/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Are you able to logon to the Administrator account in safe mode? If so, try toggling your user account to limited then back to admin. If no joy regaining admin rights, but you can access the Administrator account, run a Deckards scan from there.
