#1
Member
Profile: Join Date: Apr 2005
Location: Wiltshire, England
Posts: 48
Computer Experience:
Virus/Malware issue
I clicked on a link from a mates msn message and it kindly put some sort of virus/malware onto my PC. So could someone in the know please look over these logs and give me some help with ridding my PC of this. Avira AntiVir seems to be unable to find quite a lot of it.HJT Log:
Quote:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)SP1 (WinNT 6.00.1905)http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.kaspersky.com/kos/eng/par...an_unicode.cab
Quote:
Thursday, March 27, 2008 3:51:11 PMms Object is locked skippedms Object is locked skippedms Object is locked skippedms Object is locked skippedms Object is locked skippedms Object is locked skippedms Object is locked skippedms Object is locked skipped
Thanks very much.
Didn't find the information you thought to find?Similar Threads
#2
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Hi nobbie this topic , install the latest version of Hijackthis, run a scan and save the log (you can close it for now). Then, download and run Deckard's System Scanner and post BOTH the main.txt and extra.txt logs. You may be required to put them in sepearate posts due to character count limitations.
#3
Member
Profile: Join Date: Apr 2005
Location: Wiltshire, England
Posts: 48
Computer Experience:
Hi noahdfear,HJT , here is the log:
Quote:
Logfile of Trend Micro HijackThis v2.0.2SP1 (WinNT 6.00.1905)http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.kaspersky.com/kos/eng/par...an_unicode.cab Ad -Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files (x86)\Lavasoft\Ad -Aware 2007\aawservice.exe
#4
Member
Profile: Join Date: Apr 2005
Location: Wiltshire, England
Posts: 48
Computer Experience:
Here are the two Deckards logs,
Quote:
Deckard's System Scanner v20071014.68Ad -Aware 2007Ad -Aware 2007SP1 (WinNT 6.00.1905)dss .exehttp://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.kaspersky.com/kos/eng/par...an_unicode.cab Ad -Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files (x86)\Lavasoft\Ad -Aware 2007\aawservice.exeatapi (IDE Channel) - c:\windows\system32\drivers\atapi .sys (file missing)ISA /EISA Class Driver) - c:\windows\system32\drivers\msisadrv.sys (file missing)pci (PCI Bus Driver) - c:\windows\system32\drivers\pci .sys (file missing)TCP /IP Protocol Driver) - c:\windows\system32\drivers\tcpip.sys (file missing)RDP Encoder Mirror Driver) - c:\windows\system32\drivers\rdpencdd.sys (file missing)TCP /IP and TCP /IPv6 Protocol (SMB session)) - c:\windows\system32\drivers\smb.sys (file missing)TCP /IP Registry Compatibility) - c:\windows\system32\drivers\tcpipreg.sys (file missing)HTTP - c:\windows\system32\drivers\http .sys (file missing)BIOS Driver) - c:\windows\system32\drivers\mssmbios.sys (file missing)WAN Driver) - c:\windows\system32\drivers\ndiswan.sys (file missing)WAN Miniport (PPTP)) - c:\windows\system32\drivers\raspptp.sys (file missing)WAN Miniport (L2TP)) - c:\windows\system32\drivers\rasl2tp.sys (file missing)WAN Miniport (SSTP)) - c:\windows\system32\drivers\rassstp.sys (file missing)IP Traffic Filter Driver) - c:\windows\system32\drivers\ipfltdrv.sys (file missing)IP Network Address Translator) - c:\windows\system32\drivers\ipnat.sys (file missing)RDP Winstation Driver) - c:\windows\system32\drivers\rdpwd.sys (file missing)IP ARP Driver) - c:\windows\system32\drivers\wanarp.sys (file missing)AMD K8 Processor Driver) - c:\windows\system32\drivers\amdk8.sys (file missing)ISA /EISA Bus Driver) - c:\windows\system32\drivers\isapnp.sys (file missing)
The rest is continued in the next post as it exceeds the character limit
#5
Member
Profile: Join Date: Apr 2005
Location: Wiltshire, England
Posts: 48
Computer Experience:
Quote:
-- Find3M Report ---------------------------------------------------------------www.007guard.com www.008k.com www.00hq.com www.032439.com
and Extra.txt:
Quote:
Deckard's System Scanner v20071014.68CPU 0: Intel(R) Core(TM)2 CPU 6600 @ 2.40GHzATA Device - 149.05 GiB - 1 partitionATA Device - 232.88 GiB - 1 partitionDisabled JS ;.JSE;.WSF;.WSH;.MSC(admin) SP1 ) --> msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}SP1 ) --> msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}SP1 ) --> msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}SP1 ) --> msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}SP1 ) --> msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}SP1 ) --> msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}SP1 ) --> msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}SP1 ) --> msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}SP1 ) --> msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}SP1 ) --> msiexec /package {90120000-002A-0000-1000-0000000FF1CE} /uninstall {00C5525B-3CB3-467D-8100-2E6FB306CD86}SP1 ) --> msiexec /package {90120000-002A-0409-1000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}SP1 ) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}SP1 ) --> msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}SP1 ) --> msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}SP1 ) --> msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}SP1 ) --> msiexec /package {90120000-00BA-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}SP1 ) --> msiexec /package {90120000-0114-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}SP1 ) --> msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}SP1 ) --> msiexec /package {90120000-0116-0409-1000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}SP1 ) --> msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}Ad -Aware 2007 --> MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}SP2 (KB936181) --> MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}SP2 (KB941833) --> MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
Cheers
#6
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
I see nothing unusual in those logs. You do have a BHO that should be removed using HijackThis.
#7
Member
Profile: Join Date: Apr 2005
Location: Wiltshire, England
Posts: 48
Computer Experience:
No, i'm not getting any alerts or anything. I downloaded this file that was clearly sent through a mates MSN by some kind of malware. I ran all my antivirus/anti spyware programmes, they found nothing, then i did the kapersky online sacn which told me i was infected but you have to pay to get them to remove the infections. My antivirus then about an hour after me doing a full system scan found a virus just with its real time scanner, i deleted that but was worried that there may have been more copies of it/further infection. So if it looks clean then it may well be.
#8
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Keep an eye on things, especially when using MSN. If you notice anything peculiar, don't hesitate to post back and we'll dig deeper.
All times are GMT +1. The time now is 13:23 .
