#1
Inactive
Profile: Join Date: Aug 2008
Posts: 20
Computer Experience:
Help needed,HJT log
Hi can anyone help me fix my PC?I have a big warning on my desktop wanting me to click a link to download removal software and loads of stuff has vanished eg control panel,run etc and my av and spyware remover no longer work.I can only access the internet etc in safe mode now.I darent come out of safe mode incase I cant get back as each time Ive had to use the msconfig thing(F8 not working) to get into safe mode,the run button has disappeared and Ive had to log on to another family members account to get back before run disappears again and there are no more accounts to use!Ive just scanned with HJT and heres the result,unfortunately it means nothing to me so I,d be extremely grateful for some advice.SP2 (WinNT 5.01.2600)Ad -Aware 2007\aawservice.exehttp://upload.facebook.com/controls/...oUploader5.cab http://www.webcamcancun.com/WinWebPush.cab http://campash.brett-robinson.com/ac...CamControl.cab https://ukplay.toontown.com/download....21/ttinst.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab Ad -Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware 2007\aawservice.exe
Didn't find the information you thought to find?Similar Threads
#2
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
Welcome to WindowsBBS coopsey here , saving the file to your desktop.Close all open programs and windows Double click combofix.exe and follow the prompts.
It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
#3
Inactive
Profile: Join Date: Aug 2008
Posts: 20
Computer Experience:
Thank you.Heres the info you requestedWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! ad .yieldmanager[1].txtad .yieldmanager[2].txtad .yieldmanager[3].txtTCP "= 1700:TCP :MioNet Remote Drive AccessTCP "= 1641:TCP :MioNet Remote Drive Verificationhttp://www.gmer.net Ad -Aware 2007\aawservice.exeSP2 (WinNT 5.01.2600)Ad -Aware 2007\aawservice.exehttp://softwarereferral.com/jump.php...MjI6Ojg5&lid=2 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://upload.facebook.com/controls/...oUploader5.cab http://www.webcamcancun.com/WinWebPush.cab http://campash.brett-robinson.com/ac...CamControl.cab https://ukplay.toontown.com/download....21/ttinst.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab Ad -Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware 2007\aawservice.exe
#4
Inactive
Profile: Join Date: Aug 2008
Posts: 20
Computer Experience:
Oops think Ive posted 2 replies,sorry about that,didnt realise all replies have to be approved first so I wrote another.Sorry.
#5
Inactive
Profile: Join Date: Aug 2008
Posts: 20
Computer Experience:
Maybe not then lol! Anyway everything is working normally now so thankyou so much,youre a star!
#6
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
Once again, please disable any realtime protection applications. Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
http ://www.windowsbbs.com/malware-virus-removal/76423-help-needed-hijackthis-log.html#post413850
Collect::
C:\WINDOWS\pdoskegl.dll
C:\WINDOWS\rqbmvpso.dll
C:\WINDOWS\qalkfxor.dll
C:\WINDOWS\system32\mstmpxmlfun.xml
DirLook::
C:\Documents and Settings\STEVE.HOPELESS\Application Data\TmpRecentIcons
Folder::
C:\Program Files\temp01
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"="" Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and a fresh HijackThis log.Please do not click on the ComboFix window while it is running a scan. This can cause it to stall. P2P - I see you have P2P software (uTorrent, Limewire ) installed on your machine. I'm not passing judgment on file-sharing as a concept. However, I will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page here , here and here .
#7
Inactive
Profile: Join Date: Aug 2008
Posts: 20
Computer Experience:
Again here are the logs you requested.I have submitted the file as requested also.WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! TCP "= 1700:TCP :MioNet Remote Drive AccessTCP "= 1641:TCP :MioNet Remote Drive Verificationhttp://www.gmer.net SP2 (WinNT 5.01.2600)Ad -Aware 2007\aawservice.exehttp://uk.msn.com/?ocid=iehp http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://upload.facebook.com/controls/...oUploader5.cab http://www.webcamcancun.com/WinWebPush.cab http://campash.brett-robinson.com/ac...CamControl.cab https://ukplay.toontown.com/download....21/ttinst.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab Ad -Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware 2007\aawservice.exe
#8
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
Looks good. Download ATF Cleaner by Atribune and save it to your Desktop.Double click ATF-Cleaner.exe to run the program.
Check the boxes to the left of: Windows Temp
Current User Temp
All Users Temp
Temporary Internet Files
Prefetch
Java Cache
Recycle bin
The rest are optional - if you want it to remove everything check "Select All".
Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK then exit.
Reboot Kaspersky WebScanner Yes .The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:Scan using the following Anti-Virus database: Extended (if available otherwise Standard) Scan Archives
Click OK
Now under select a target to scan:
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.Now click on the Save as Text button:
Save the file to your desktop.
#9
Inactive
Profile: Join Date: Aug 2008
Posts: 20
Computer Experience:
Hi here is the report.
#10
Inactive
Profile: Join Date: Aug 2008
Posts: 20
Computer Experience:
Hello again,I have changed my antivirus software from CA to Bitdefender and scanned the PC with this and again with the Kaspersky online scan since my last post and I think a couple of threats have been removed so here are the most recent kaspersky and hjt logs. ThanksSP2 (WinNT 5.01.2600)Ad -Aware 2007\aawservice.exehttp://uk.msn.com/?ocid=iehp http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://upload.facebook.com/controls/...oUploader5.cab http://www.kaspersky.nl/scanforvirus...an_unicode.cab http://www.webcamcancun.com/WinWebPush.cab http://campash.brett-robinson.com/ac...CamControl.cab https://ukplay.toontown.com/download....21/ttinst.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab Ad -Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware 2007\aawservice.exe
#11
Inactive
Profile: Join Date: Aug 2008
Posts: 20
Computer Experience:
Hi now the new AV is telling me there is a Trojan in c:\windows\system32\dmserver.dll but it cant take any action.
#12
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
That might be a false positive detection. Please submit the file to Jotti for analysis and let me know the outcome.
#13
Inactive
Profile: Join Date: Aug 2008
Posts: 20
Computer Experience:
Hi,wont let me submit the file.It says that either firewall or malware is preventing it.Tried with my firewall off but still not submitting file.
#14
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
Lets grab it with ComboFix.contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
http ://www.windowsbbs.com/malware-virus-removal/76423-help-needed-hjt -log.html
Suspect::[22]
c:\windows\system32\dmserver.dll Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run (allow it to update) and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and a fresh HijackThis log.Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
#15
Inactive
Profile: Join Date: Aug 2008
Posts: 20
Computer Experience:
Hi,not getting the prompt after running combofix??Also the AV is no longer giving me the virus warning.Here's both the logs anyway.WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! TCP "= 1700:TCP :MioNet Remote Drive AccessTCP "= 1641:TCP :MioNet Remote Drive Verificationhttp://www.gmer.net SP2 (WinNT 5.01.2600)Ad -Aware 2007\aawservice.exehttp://uk.msn.com/?ocid=iehp http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://upload.facebook.com/controls/...oUploader5.cab http://www.kaspersky.nl/scanforvirus...an_unicode.cab http://www.webcamcancun.com/WinWebPush.cab http://campash.brett-robinson.com/ac...CamControl.cab https://ukplay.toontown.com/download....21/ttinst.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab Ad -Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware 2007\aawservice.exe
All times are GMT +1. The time now is 15:51 .
