#1
Member
Profile: Join Date: Sep 2008
Posts: 4
Computer Experience:
[InActive] Computer slowed down and google search is hijacked
Hello,SP3 (WinNT 5.01.2600)http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.speedship.com/ http://www.andhrajyothy.com/wfplayer/tdserver.cab http://www-307.ibm.com/pc/support/acpir.cab http://dl.tvunetworks.com/TVUAx.cab http://www.update.microsoft.com/micr...?1185464896421 http://www.update.microsoft.com/micr...?1185464880312 http://www-307.ibm.com/pc/support/IbmEgath.cab https://inotes.perficient.com/dwa8W.cab HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.exe
Didn't find the information you thought to find?Similar Threads
#2
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
Welcome to WindowsBBS LostinLA Download RSIT by random/random and save it to your desktop.
Double click RSIT.exe to start the tool.
At the disclaimer, please use the drop down box to select 3 months for the file/folder search, then click Continue.
When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized.
Please post the contents of log.txt here in your next reply.
#3
Member
Profile: Join Date: Sep 2008
Posts: 4
Computer Experience:
Thank you for the reply, Noahdfear RAM : 2030 MB (66% free)SP3 (WinNT 5.01.2600)http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.speedship.com/ http://www.andhrajyothy.com/wfplayer/tdserver.cab http://www-307.ibm.com/pc/support/acpir.cab http://dl.tvunetworks.com/TVUAx.cab http://www.update.microsoft.com/micr...?1185464896421 http://www.update.microsoft.com/micr...?1185464880312 http://www-307.ibm.com/pc/support/IbmEgath.cab https://inotes.perficient.com/dwa8W.cab HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.exe
#4
Member
Profile: Join Date: Sep 2008
Posts: 4
Computer Experience:
======List of files/folders created in the last 3 months======HD ---- C:\Config.MsiHD ---- C:\WINDOWS\infHD ---- C:\WINDOWS\$hf_mig$WLAN Transport; C:\WINDOWS\system32\DRIVERS\s24trans.sys [2007-11-20 12288]LAN Access Server; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2007-06-29 156392]PCI Express Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e1e5132.sys [2008-01-02 252048]HDD APS Logging Service; C:\WINDOWS\System32\TPHDEXLG.exe [2007-10-16 37424]SMTP ); C:\WINDOWS\system32\inetsrv\inetinfo.exe [2008-04-14 15360]Ad -Aware Service; C:\Program Files\Lavasoft\Ad -Aware\aawservice.exe [2008-09-22 611664]Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]DHCP Service; C:\WINDOWS\system32\vmnetdhcp.exe [2007-09-06 106496]
#5
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
Your log shows signs of a rootkit infection. Download ComboFix by sUBs from here , saving the file to your desktop.this link for your applicable programs.Close all open programs and windows Double click combofix.exe and follow the prompts.
It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
#6
Member
Profile: Join Date: Sep 2008
Posts: 4
Computer Experience:
Sorry for the delayed reply. I was traveling. Here is my combofix log:WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! http://www.gmer.net
#7
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,521
Computer Experience:
Great! Looks like there were just a few remnants, and those were removed by ComboFix. Lets get an online scan now to make sure I haven't overlooked something. Please do an online scan with Kaspersky Online Scanner Accept , when prompted to download and install the program files and database of malware definitions.Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Click View scan report at the bottom.
Click the Save Report As... button.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.
**Note** Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.
All times are GMT +1. The time now is 01:13 .
isabled:tib emsd"
