#1
Inactive
Profile: Join Date: Jan 2008
Posts: 8
Computer Experience:
Trojan Horse Back Door, Buffer Overrun...
I'm being overrun with pop ups . AVG Suite is running and "Threat detected while opening C:\windows\system32\drivers\RDPCDDD.sys Trojan Horse Back Doo Generic 9.OEP" but cannot heal. Also identified Adware Generic 2.AAUT while opening file C:\Windos\System32\qwnrytzgs.dll. AVG ystem Scan test results report 55 threats found, 0 cleaned, 43 moved to vault and 12 deleted. I'm getting "Buffer Overrun detected" system messages. HJT log. Thanks for any suggestions.SP2 (WinNT 5.01.2600)http://www.dell4me.com/myway http://www.yahoo.com/ http://www.yahoo.com/ http://us.rd.yahoo.com/customize/ie/...ch/search.html http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com http://www.yahoo.com/ http://www.dell4me.com/myway http://asp.mathxl.com/books/_Players...stallAsst2.cab http://us.dl1.yimg.com/download.yaho...tocomplete.cab http://asp.mathxl.com/books/_Players/MathPlayer.cab
Didn't find the information you thought to find?Similar Threads
#2
Senior Member
Profile: Join Date: Jan 2007
Location: Ontario
Posts: 355
Computer Experience:
Hi and welcome,http://www.techsupportforum.com/sect...eckard/dss.exe http://deckard.geekstogo.com/dss.exe dss .exe to run it, and follow the prompts.DSS will do:Note dss -- please note as close as possible the error(s).
#3
Inactive
Profile: Join Date: Jan 2008
Posts: 8
Computer Experience:
Log Files, as you requested
Blender, Thanks - I'll get McAfee off. Our IT contractor installed the AVG and was supposed to have removed McAfee, and I figured it was somthing I needed. DSS log you asked for. I am also posting separately the extra .txt file and finally, results of my AVG scan file. Thanks!Total Physical Memory: 510 MiB (512 MiB recommended). dss .exehttp://www.dell4me.com/myway http://www.google.com/ie http://www.google.com http://www.yahoo.com/ http://www.google.com/ie http://www.google.com/search?q=%s http://www.dell4me.com/myway http://www.yahoo.com/ http://www.google.com/ie http://us.rd.yahoo.com/customize/ie/...ch/search.html http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com http://www.yahoo.com/ http://www.google.com/ie http://www.google.com/ie https://hanapps.hanover-co.com (HKCU)http://www.apple.com/qtactivex/qtplugin.cab http://asp.mathxl.com/books/_Players...stallAsst2.cab http://us.dl1.yimg.com/download.yaho...tocomplete.cab http://fpdownload.macromedia.com/get...nt/swflash.cab http://asp.mathxl.com/books/_Players/MathPlayer.cab ms -itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLLhttp://www.beyondlogic.org; Command Line Process Utility>
#4
Inactive
Profile: Join Date: Jan 2008
Posts: 8
Computer Experience:
Extra Logfile
Deckard's System Scanner v20071014.68CPU 0: Intel(R) Pentium(R) 4 CPU 3.00GHzCPU 1: Intel(R) Pentium(R) 4 CPU 3.00GHzJS ;.JSE;.WSF;.WSH(admin) (admin) (admin) (admin) (admin) Ad -Aware SE Personal --> C:\PROGRA~1\Lavasoft\AD -AWA~2\UNWISE.EXE C:\PROGRA~1\Lavasoft\AD -AWA~2\INSTALL.LOGPCI \VEN_8086&DEV_2572DNS server list :IP Address(es) :DNS server contacted refused the update request. The reasons for thisDNS domain name,DNS server authoritative for this name does not supportDNS dynamic update protocol.DNS host (A) resource records using the specific DNS IP addresses for this adapter, contact your DNS server
#5
Inactive
Profile: Join Date: Jan 2008
Posts: 8
Computer Experience:
Main logfile from DSS
Blender: Thanks for your help. I tried to post a reply with this file but it doesn't appear to have posted. Here is another try:Total Physical Memory: 510 MiB (512 MiB recommended). dss .exehttp://www.dell4me.com/myway http://www.google.com/ie http://www.google.com http://www.yahoo.com/ http://www.google.com/ie http://www.google.com/search?q=%s http://www.dell4me.com/myway http://www.yahoo.com/ http://www.google.com/ie http://us.rd.yahoo.com/customize/ie/...ch/search.html http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com http://www.yahoo.com/ http://www.google.com/ie http://www.google.com/ie https://hanapps.hanover-co.com (HKCU)http://www.apple.com/qtactivex/qtplugin.cab http://asp.mathxl.com/books/_Players...stallAsst2.cab http://us.dl1.yimg.com/download.yaho...tocomplete.cab http://fpdownload.macromedia.com/get...nt/swflash.cab http://asp.mathxl.com/books/_Players/MathPlayer.cab ms -itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLLhttp://www.beyondlogic.org; Command Line Process Utility>
#6
Inactive
Profile: Join Date: Jan 2008
Posts: 8
Computer Experience:
AVG Scanner Logfile
Here is the AVG scan you requestedad .yieldmanager[2].txt","","Potentially Unwanted Program, Moved to Vault"
#7
Staff
Profile: Join Date: May 2002
Location: Staffordshire, UK
Posts: 21,685
Computer Experience:
mikeredbank
Quote:
I tried to post a reply with this file but it doesn't appear to have posted.
As you are a new member here with less than 10 posts every post you make which includes a URL will be sent to the Moderating queue for a Moderator to approve. Until the post has been approved you will not see it
#8
Senior Member
Profile: Join Date: Jan 2007
Location: Ontario
Posts: 355
Computer Experience:
Hey Mike,http://www.bleepingcomputer.com/comb...o-use-combofix
#9
Inactive
Profile: Join Date: Jan 2008
Posts: 8
Computer Experience:
Combo fix Log
Hi Blender, here is the txt log....http://www.gmer.net
#10
Senior Member
Profile: Join Date: Jan 2007
Location: Ontario
Posts: 355
Computer Experience:
Hi,CFScript.txt It must be on desktop to work
Code:
Driver::
RDPCDDD
Folder::
C:\Temp\tn3
C:\Program Files\Dot1XCfg
C:\WINDOWS\Installer\{8eac7861-0efc-47ab-a396-c85fc04cc75f}
C:\WINDOWS\TWlrZURvd2Qx
C:\WINDOWS\SYSTEM32\wnis6
C:\WINDOWS\SYSTEM32\nip4
C:\WINDOWS\SYSTEM32\nGpxx01
C:\WINDOWS\SYSTEM32\ets1
C:\WINDOWS\SYSTEM32\comg9
C:\Temp\gTiis19
C:\Temp\cXzz9
File::
C:\WINDOWS\SYSTEM32\DRIVERS\core.cache.dsk
C:\WINDOWS\system32\drivers\RDPCDDD.sys
REgistry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D379CEA-2372-07AA-5767-5900BCC78891}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Iacequct"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"SysComponent"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqrqon] Once you get it saved, close all running applications including antivirus/antispyware programs.http://i100.photobucket.com/albums/m...i/CFScript.gif
#11
Inactive
Profile: Join Date: Jan 2008
Posts: 8
Computer Experience:
Combo Fix Log files
ComboFix 08-01-31.1 - mike 2008-01-31 18:01:10.2 - NTFSx86http://www.gmer.net
#12
Inactive
Profile: Join Date: Jan 2008
Posts: 8
Computer Experience:
HJT Log file
Logfile of Trend Micro HijackThis v2.0.0 (BETA)SP2 (WinNT 5.01.2600)http://www.yahoo.com/ http://www.yahoo.com/ http://us.rd.yahoo.com/customize/ie/...ch/search.html http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com http://www.yahoo.com/ http://www.dell4me.com/myway http://asp.mathxl.com/books/_Players...stallAsst2.cab http://us.dl1.yimg.com/download.yaho...tocomplete.cab http://asp.mathxl.com/books/_Players/MathPlayer.cab
#13
Senior Member
Profile: Join Date: Jan 2007
Location: Ontario
Posts: 355
Computer Experience:
Hi,http://service.mcafee.com/FAQDocumen...107083&lc=4105 http://www.bleepingcomputer.com/star...exe-16996.html http://hijack1.trend-braintree.com/h...HJTInstall.exe http://download.bleepingcomputer.com...HJTInstall.exe http://www.trendsecure.com/portal/en...HJTinstall.exe Make sure you DO NOT fix anything with Hijack This yet. Most of the things in the log are normal or required.
All times are GMT +1. The time now is 12:28 .
isabled:Internet Explorer"
