#1
Inactive
Profile: Join Date: Mar 2008
Posts: 22
Computer Experience:
Lost admin rights
I have lost control of my computer. All my administrative rights are gone. I cant open task manager, control panel, and other things. It says something about the restrictions on my computer and I need to check with my administrator. I also get alot of pop ups and the computer is running very slow. SP1 (WinNT 5.01.2600)SP1 (6.00.2800.1106)http://srch-us9.hpwis.com/ http://us9.hpwis.com/ http://w4s2.work4sure.com/c/ge/w4sgeen9.exe http://go.microsoft.com/fwlink/?linkid=39204 ms -its:mhtml:file://c:\\nores.mht!http://adxtnet.net/code/chm/xpre.chm::/xpreload.ocx https://secure.logmein.com/activex/RACtrl.cab WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Didn't find the information you thought to find?Similar Threads
#2
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Welcome to WindowsBBS covian here , saving the file to your desktop.this link for your applicable programs.Close all open programs and windows Double click combofix.exe and follow the prompts.
It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
#3
Inactive
Profile: Join Date: Mar 2008
Posts: 22
Computer Experience:
Alright below is the what you requestedjs js 0 005480D0 009F9C50 02261060 1E1820D0 4F3435F.bin0 4F34469.bin0 4F344D6.bin0 4F34534.bin0 5308D9E.bin0 AFE3CC3.bin0 AFE3DBD.bin0 AFE3E88.bin0 AFE3F05.bin0 BE8DFD70 E7AEAB4.CVOYw0 E7AEE4D.bin0 E7AEEEA.bin0 E7AEFB5.bin0 E7AF090.bin0 E7AF12C.bin0 c20 c2\tmpFF.log0 00080.exe0 00090.exehttp://www.gmer.net
#4
Inactive
Profile: Join Date: Mar 2008
Posts: 22
Computer Experience:
Below is the HijackThisSP1 (WinNT 5.01.2600)SP1 (6.00.2800.1106)http://srch-us9.hpwis.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://w4s2.work4sure.com/c/ge/w4sgeen9.exe http://go.microsoft.com/fwlink/?linkid=39204 ms -its:mhtml:file://c:\\nores.mht!http://adxtnet.net/code/chm/xpre.chm::/xpreload.ocx https://secure.logmein.com/activex/RACtrl.cab WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
#5
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Open the StopSign antivirus and remove all quarantined items.here or here and save the file to your desktop.mbam-setup.exe to install the application.Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware , then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select 'Perform Quick Scan ', then click Scan .
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked , and click Remove Selected .
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Post the entire report in your next reply along with a fresh HijackThis log.
#6
Inactive
Profile: Join Date: Mar 2008
Posts: 22
Computer Experience:
Malwarebytes' Anti-Malware 1.11
#7
Inactive
Profile: Join Date: Mar 2008
Posts: 22
Computer Experience:
Logfile of Trend Micro HijackThis v2.0.2SP1 (WinNT 5.01.2600)SP1 (6.00.2800.1106)http://srch-us9.hpwis.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://w4s2.work4sure.com/c/ge/w4sgeen9.exe http://go.microsoft.com/fwlink/?linkid=39204 https://secure.logmein.com/activex/RACtrl.cab WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
#8
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Lots of progress! http://w4s2.work4sure.com/c/ge/w4sgeen9.exe Deckard's System Scanner (dss .exe) and save it to your desktop.Close all applications and windows Double click on dss .exe to run it and follow the prompts.
When the scan is complete, two text files will open; main.txt , which will be maximized and extra.txt , which will be minimized.
#9
Inactive
Profile: Join Date: Mar 2008
Posts: 22
Computer Experience:
I put the keylogger there.Total Physical Memory: 504 MiB (512 MiB recommended). SP1 (WinNT 5.01.2600)SP2 (6.00.2800.1106)dss .exehttp://srch-us9.hpwis.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896
#10
Inactive
Profile: Join Date: Mar 2008
Posts: 22
Computer Experience:
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"http://go.microsoft.com/fwlink/?linkid=39204 https://secure.logmein.com/activex/RACtrl.cab WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exehttp://us9.hpwis.com/ http://w4s2.work4sure.com/c/ge/w4sgeen9.exe .cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%* .cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%* .reg - regfile - shell\open\command - regedit.exe "%1" %* .scr - scrfile - shell\open\command - "%1" %* atapi .sys <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System>http://www.beyondlogic.org; Command Line Process Utility>
#11
Inactive
Profile: Join Date: Mar 2008
Posts: 22
Computer Experience:
-- Registry Dump ---------------------------------------------------------------
#12
Inactive
Profile: Join Date: Mar 2008
Posts: 22
Computer Experience:
Deckard's System Scanner v20071014.68CPU 0: Intel(R) Pentium(R) 4 CPU 2.60GHzCF Reader USB DeviceMS Reader USB Device - 117.66 MiB - 1 partitionMS -DOS V4 Huge - 123.73 MiB - I:JS ;.JSE;.WSF;.WSH(admin) (admin) PCI \VEN_8086&DEV_2572
#13
Inactive
Profile: Join Date: Mar 2008
Posts: 22
Computer Experience:
Thanks alot for all your help.I put the first half of main text again because im not sure if the post went through.. I did install key logger but i think i removed it. CPU 0: Intel(R) Pentium(R) 4 CPU 2.60GHzCF Reader USB DeviceMS Reader USB Device - 117.66 MiB - 1 partitionMS -DOS V4 Huge - 123.73 MiB - I:JS ;.JSE;.WSF;.WSH(admin) (admin) PCI \VEN_8086&DEV_2572
#14
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Highlight and copy the bolded command below."%userprofile%\desktop\dss .exe" /daft Click Start>Run and paste the command in, then hit enter.
An interface of Deckards file association fix will open.
Click Scan.
You should the following come up in the list..cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*
.reg - regfile - shell\open\command - regedit.exe "%1" %*
.scr - scrfile - shell\open\command - "%1" %*
Check the box next to then, then click Fix.
Exit when complete.
here , saving it to your desktop.contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
File::
C:\WINDOWS\Tasks\874237A78325AAB3.job
C:\WINDOWS\glypoxkj.dll
C:\Documents and Settings\All Users\Application Data\ahadypex.dll
Folder::
C:\Documents and Settings\All Users\Application Data\dktofqxe
C:\WINDOWS\cuawsppw
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Jfw"=- Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and another fresh HijackThis log.Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
#15
Inactive
Profile: Join Date: Mar 2008
Posts: 22
Computer Experience:
When I pasted the stuff in the run box it gave me an error. Also I cant seem to find ComboFix so I can do the second part of your instructions.
All times are GMT +1. The time now is 05:03 .
