#1
Geek Member
Profile: Join Date: Mar 2003
Location: Glen Allen, VA
Posts: 560
Computer Experience:
[Resolved]Need some help for my son's PC
My son has somehow managed to get his PC infected. I've run Spybot, Malwarebytes Antimalware and Avir Antivirus and they've all cleaned up a bunch of stuff. I'm posting the HJT log to see if there's anything the others have missed. It seems to be a lot better than it was when I first started on it, I could only get it to boot into Safe Mode, it was freezing solid right after the desktop loaded.SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)hjt \HijackThis.exehttp://messenger.zone.msn.com/binary...r.cab56986.cab http://messenger.zone.msn.com/EN-CA/.../GAME_UNO1.cab http://messenger.zone.msn.com/binary...o.cab56649.cab http://messenger.zone.msn.com/binary...t.cab56907.cab http://messenger.zone.msn.com/binary...r.cab56986.cab https://secure.logmein.com/activex/ractrl.cab?lmi=100
Didn't find the information you thought to find?Similar Threads
#2
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,549
Computer Experience:
Hi Billscan only . Check the boxes next to all the entries listed below. O3 - Toolbar: fdkowvbp - {D0B319CC-BD7D-4AD1-AFD0-0AEA47E33831} - C:\WINDOWS\fdkowvbp.dll (file missing) close all windows other than HiJackThis , then click Fix Checked. HJT .Now run Combofix. Here disable realtime protection applications as they sometimes interfere with the tool. this link for any applicable programs you may have.Close all open programs and windows Double click combofix.exe and follow the prompts.
Vista users When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall Note - ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.
#3
Geek Member
Profile: Join Date: Mar 2003
Location: Glen Allen, VA
Posts: 560
Computer Experience:
Hi Geri,WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! LAN GUI v2.0 Uninstaller.exehttp://www.gmer.net SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)hjt \HijackThis.exehttp://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://messenger.zone.msn.com/binary...r.cab56986.cab http://messenger.zone.msn.com/EN-CA/.../GAME_UNO1.cab http://messenger.zone.msn.com/binary...o.cab56649.cab http://messenger.zone.msn.com/binary...t.cab56907.cab http://messenger.zone.msn.com/binary...r.cab56986.cab https://secure.logmein.com/activex/ractrl.cab?lmi=100
#4
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,549
Computer Experience:
Hi Billhttp://noahdfear.geekstogo.com/FindAWF.exe
#5
Geek Member
Profile: Join Date: Mar 2003
Location: Glen Allen, VA
Posts: 560
Computer Experience:
Hi Geri,
#6
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,549
Computer Experience:
Hi Bill"C:\WINDOWS\bak\SiSUSBrg.exe" Run FindAWF again and select option 2.
Press any key to continue at the Thank you screen.
A text file will open named files.txt.
Click below the line in files.txt, then right click and paste the list of files.
Close files.txt and save the changes.
FindAWF will restore the files to their original location and automatically do another scan.
When complete, awf.txt will open.
Please post it's contents.
#7
Geek Member
Profile: Join Date: Mar 2003
Location: Glen Allen, VA
Posts: 560
Computer Experience:
Hi Geri,
#8
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,549
Computer Experience:
Hi BillC:\WINDOWS\bak Run FindAWF again and select option 3.
A text file will open named folders.txt.
Click below the line in folders.txt, then right click and paste the list of folders.
Close folders.txt and save the changes.
FindAWF will delete the folders and automatically do another scan.
When complete, awf.txt will open.
Please post it's contents.
#9
Geek Member
Profile: Join Date: Mar 2003
Location: Glen Allen, VA
Posts: 560
Computer Experience:
Hi Geri,
#10
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,549
Computer Experience:
Hi BillC:\Program Files\QuickTime\bak CF log that were hard to get much info on so lets run a on-line scan.Kaspersky WebScanner Yes .The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:Scan using the following Anti-Virus database: Extended (if available otherwise Standard) Scan Archives
Click OK
Now under select a target to scan:
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.Now click on the Save as Text button:
Save the file to your desktop.
#11
Geek Member
Profile: Join Date: Mar 2003
Location: Glen Allen, VA
Posts: 560
Computer Experience:
Hi Geri,
#12
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,549
Computer Experience:
Hi Billbak BAK Kaspersky WebScanner Click on “Accept” If your pop –up blocker blocks any windows from opening. Click Run on the window that opens .Windows Vista users you must open the web browser using the Run as Administrator command.The program will launch and then begin downloading the latest definition files:
Under Scan on the left side.Click on My Computer
This will start the program and scan your system.
Click the “Scan Report” On the left side.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected. Click the Save Report As button, and in the Browse dialog box, type a name for the scan report file that you want to create and select its type Text file . Click OK to save the file.:
Save the text file to your desktop.
Copy and paste that information in your next post.
#13
Geek Member
Profile: Join Date: Mar 2003
Location: Glen Allen, VA
Posts: 560
Computer Experience:
Hi Geri,
#14
Geek Member
Profile: Join Date: Mar 2003
Location: Glen Allen, VA
Posts: 560
Computer Experience:
Hi Geri,
#15
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,549
Computer Experience:
Hi BillmIRC is a on-line chat program.LogMeIn RemoteAnywhere is a remote administration tool so you can check emails and such from another computer.ComboFix /u then hit Enter to uninstall ComboFix and remove the files/folders it created. This action will also reset the System Restore points, removing the infected files there as well.
All times are GMT +1. The time now is 10:17 .
