#1
Member
Profile: Join Date: Jul 2009
Posts: 8
Computer Experience:
[Resolved] anamalous laptop behavior
Hi -Ad -Watch Live! Anti-Virus *On-access scanning disabled* (Updated) {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}Ad -Aware\AAWService.exeAd -Aware\AAWTray.exeHJT Report ===============js : browser.startup.homepage - hxxp://www.yahoo.com/js - pref("media.enforce_same_site_origin", false);js - pref("media.cache_size", 51200);js - pref("media.ogg.enabled", true);js - pref("media.wave.enabled", true);js - pref("media.autoplay.enabled", true);js - pref("browser.urlbar.autocomplete.enabled", true);js - pref("capability.policy.mailnews.*.wholeText", "noAccess");js - pref("dom.storage.default_quota", 5120);js - pref("content.sink.event_probe_rate", 3);js - pref("network.http .prompt-temp-redirect", true);js - pref("layout.css.dpi", -1);js - pref("layout.css.devPixelsPerPx", -1);js - pref("gestures.enable_single_finger_input", true);js - pref("dom.max_chrome_script_run_time", 0);js - pref("network.tcp .sendbuffer", 131072);js - pref("geo.enabled", true);js - pref("security.remember_cert_checkbox_default_setting", true);js - pref("browser.search.param.yahoo-fr", "moz35");js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");js - pref("extensions.blocklist.level", 2);js - pref("browser.urlbar.restrict.typed", "~");js - pref("browser.urlbar.default.behavior", 0);js - pref("privacy.clearOnShutdown.history", true);js - pref("privacy.clearOnShutdown.formdata", true);js - pref("privacy.clearOnShutdown.passwords", false);js - pref("privacy.clearOnShutdown.downloads", true);js - pref("privacy.clearOnShutdown.cookies", true);js - pref("privacy.clearOnShutdown.cache", true);js - pref("privacy.clearOnShutdown.sessions", true);js - pref("privacy.clearOnShutdown.offlineApps", false);js - pref("privacy.clearOnShutdown.siteSettings", false);js - pref("privacy.cpd.history", true);js - pref("privacy.cpd.formdata", true);js - pref("privacy.cpd.passwords", false);js - pref("privacy.cpd.downloads", true);js - pref("privacy.cpd.cookies", true);js - pref("privacy.cpd.cache", true);js - pref("privacy.cpd.sessions", true);js - pref("privacy.cpd.offlineApps", false);js - pref("privacy.cpd.siteSettings", false);js - pref("privacy.sanitize.migrateFx3Prefs", false);js - pref("browser.ssl_override_behavior", 2);js - pref("security.alternate_certificate_error_page", "certerror");js - pref("browser.privatebrowsing.autostart", false);js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);js - pref("geo.wifi.uri", "https://www.google.com/loc/json");Ad -Aware Service;Lavasoft Ad -Aware Service;c:\program files\lavasoft\ad -aware\AAWService.exe [2009-1-18 1029456]WLAN USB Adapter;c:\windows\system32\drivers\TUSB1150.sys [2008-7-31 494848]FTP PCI \VEN_8086&DEV_4220&SUBSYS_12F5103C&REV_05\4&1D3F0FBB&0&28F0PCI \VEN_8086&DEV_4220&SUBSYS_12F5103C&REV_05\4&1D3F0FBB&0&28F0NIC PCI \VEN_10EC&DEV_8139&SUBSYS_309D103C&REV_10\4&1D3F0FBB&0&38F0NIC PCI \VEN_10EC&DEV_8139&SUBSYS_309D103C&REV_10\4&1D3F0FBB&0&38F0Ad -AwareLAN AdapterFTP SP1 (KB953595)SP1 (KB958484)SP1 SP2 (KB925672)SP2 (KB927978)SP2 (KB936181)SP2 (KB954430)NIC DriverSP1 (KB963707)SP2 IP address 192.168.1.103. The machine with the IP address 192.168.1.102 did not allow the name to be claimed by this machine.Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 00120E530910. The following error occurred: The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP ) server.Dhcp [1002] - The IP address lease 192.168.1.103 for the Network Card with network address 00120E530910 has been denied by the DHCP server 192.168.0.1 (The DHCP Server sent a DHCPNACK message).Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 00120E530910. The following error occurred: The semaphore timeout period has expired. . Your computer will continue to try and obtain an address on its own from the network address (DHCP ) server.DHCP Client service which failed to start because of the following error: The dependency service or group failed to start.DNS Client service depends on the TCP /IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.TCP /IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.TCP /IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.TCP network. The IP address of the machine that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state.IP address 192.168.1.104. The machine with the IP address 192.168.1.102 did not allow the name to be claimed by this machine.DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
Didn't find the information you thought to find?Similar Threads
#2
Staff
Profile: Join Date: May 2002
Location: Staffordshire, UK
Posts: 21,699
Computer Experience:
Welcome to WindowsBBS
#3
Member
Profile: Join Date: Jul 2009
Posts: 8
Computer Experience:
Hi Pete!CPU and no strange services appear in task manager that may be doing it. Autoruns, either.
#4
Staff
Profile: Join Date: May 2002
Location: Staffordshire, UK
Posts: 21,699
Computer Experience:
Thanks
#5
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 4,707
Computer Experience:
Please download ComboFix from Here Here **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop** Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Very Important! disable your anti-virus , script blocking and any anti-malware real-time protection before "unpredictable results" .Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it startsPlease do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall** Make sure, you re-enable your security programs, when you're done with Combofix.
#6
Member
Profile: Join Date: Jul 2009
Posts: 8
Computer Experience:
Hi -HJT log, with the CF log to follow:SP3 (WinNT 5.01.2600)http://www.yahoo.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=74005 http://www.symantec.com http://symantec.atgnow.com/sdccommon...ad/tgctlsi.cab https://support.microsoft.com/OAS/ActiveX/MSDcode.cab http://pcpitstop.com/pcpitstop/PCPitStop.CAB http://downloads.ewido.net/ewidoOnlineScan.cab http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab http://housecall65.trendmicro.com/ho...vex/hcImpl.cab https://support.microsoft.com/OAS/ActiveX/odc.cab http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab http://www.symantec.com/techsupp/asa...bs/tgctlsi.cab http://www.symantec.com/techsupp/asa...bs/tgctlsr.cab http://ipgweb.cce.hp.com/rdqnbk/downloads/sysinfo.cab http://catalog.update.microsoft.com/...?1193289794953 http://cdn.scan.safety.live.com/reso...scbase8460.cab http://www.update.microsoft.com/micr...?1188084861203 http://security.symantec.com/sscv6/S.../bin/cabsa.cab http://h20270.www2.hp.com/ediags/gmn...tDetection.cab http://www.update.microsoft.com/micr...?1188084842062 http://pcpitstop.com/mhLbl.cab http://support.f-secure.com/ols/fscax.cab https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx http://ax.emsisoft.com/asquared.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab http://driveragent.com/files/driveragent.cab http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll Ad -Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware\AAWService.exeWlan Service (tiwlnsvc) - Unknown owner - C:\Program Files\WiFire_xp\tiwlnsvc.exeHJT SCAN:merijn@spywareinfo.com , reporting the following:HJT AGAIN AND NO ERRORS.....ASK AND I WILL POST THAT ONE IF REQ'D
#7
Member
Profile: Join Date: Jul 2009
Posts: 8
Computer Experience:
Hi again -CF log. Thank you very much in advance.Ad -Watch Live! Anti-Virus *On-access scanning disabled* (Updated) {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}Ad -Aware\Update\Ad -AwareCommand.exeAd -Aware\Update\Ad -AwareAdmin.exeAd -Aware\Update\Ad -Aware.exeAd -Aware\Update\AAWWSC.exeAd -Aware\Update\AAWTray.exeAd -Aware\Update\AAWService.exeFTP Ad -Aware Service]Ad -Aware Service;Lavasoft Ad -Aware Service;c:\program files\Lavasoft\Ad -Aware\AAWService.exe [1/18/2009 2:34 PM 1029456]WLAN USB Adapter;c:\windows\system32\drivers\TUSB1150.sys [7/31/2008 4:00 PM 494848]Ad -Aware Update (Daily).jobAd -Aware\Ad -AwareAdmin.exe [2009-01-18 20:14]js : browser.startup.homepage - hxxp://www.yahoo.com/js - pref("media.enforce_same_site_origin", false);js - pref("media.cache_size", 51200);js - pref("media.ogg.enabled", true);js - pref("media.wave.enabled", true);js - pref("media.autoplay.enabled", true);js - pref("browser.urlbar.autocomplete.enabled", true);js - pref("capability.policy.mailnews.*.wholeText", "noAccess");js - pref("dom.storage.default_quota", 5120);js - pref("content.sink.event_probe_rate", 3);js - pref("network.http .prompt-temp-redirect", true);js - pref("layout.css.dpi", -1);js - pref("layout.css.devPixelsPerPx", -1);js - pref("gestures.enable_single_finger_input", true);js - pref("dom.max_chrome_script_run_time", 0);js - pref("network.tcp .sendbuffer", 131072);js - pref("geo.enabled", true);js - pref("security.remember_cert_checkbox_default_setting", true);js - pref("browser.search.param.yahoo-fr", "moz35");js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");js - pref("extensions.blocklist.level", 2);js - pref("browser.urlbar.restrict.typed", "~");js - pref("browser.urlbar.default.behavior", 0);js - pref("privacy.clearOnShutdown.history", true);js - pref("privacy.clearOnShutdown.formdata", true);js - pref("privacy.clearOnShutdown.passwords", false);js - pref("privacy.clearOnShutdown.downloads", true);js - pref("privacy.clearOnShutdown.cookies", true);js - pref("privacy.clearOnShutdown.cache", true);js - pref("privacy.clearOnShutdown.sessions", true);js - pref("privacy.clearOnShutdown.offlineApps", false);js - pref("privacy.clearOnShutdown.siteSettings", false);js - pref("privacy.cpd.history", true);js - pref("privacy.cpd.formdata", true);js - pref("privacy.cpd.passwords", false);js - pref("privacy.cpd.downloads", true);js - pref("privacy.cpd.cookies", true);js - pref("privacy.cpd.cache", true);js - pref("privacy.cpd.sessions", true);js - pref("privacy.cpd.offlineApps", false);js - pref("privacy.cpd.siteSettings", false);js - pref("privacy.sanitize.migrateFx3Prefs", false);js - pref("browser.ssl_override_behavior", 2);js - pref("security.alternate_certificate_error_page", "certerror");js - pref("browser.privatebrowsing.autostart", false);js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);js - pref("geo.wifi.uri", "https://www.google.com/loc/json");http://www.gmer.net
#8
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 4,707
Computer Experience:
You used outdated HJT version, so next time around...HijackThis :http://www.trendsecure.com/portal/en...kthis/download Download HijackThis Installer Combofix :Start > Run combofix /u Note the space between the "combofix" and the "/u" Dr.Web CureIt to the desktop:ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe Doubleclick the drweb-cureit.exe file and Allow to run the express scan
This will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it. This is only a short scan.
Once the short scan has finished, mark the drives that you want to scan.
Select all drives. A red dot shows which drives have been chosen.
Click the green arrow http://i154.photobucket.com/albums/s...sy69/drweb.jpg at the right, and the scan will start.
Click Yes to all if it asks if you want to cure/move the file.
When the scan has finished, in the menu, click File and choose Save report list
Save the report to your desktop . The report will be called DrWeb.csv
Close Dr.Web Cureit.
Important! Copy and paste that log in the next reply. You can use Notepad to open the DrWeb.cvs report.
#9
Member
Profile: Join Date: Jul 2009
Posts: 8
Computer Experience:
Hi again -HJT log:SP3 (WinNT 5.01.2600)http://www.yahoo.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=74005 http://www.symantec.com http://symantec.atgnow.com/sdccommon...ad/tgctlsi.cab https://support.microsoft.com/OAS/ActiveX/MSDcode.cab http://pcpitstop.com/pcpitstop/PCPitStop.CAB http://downloads.ewido.net/ewidoOnlineScan.cab http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab http://housecall65.trendmicro.com/ho...vex/hcImpl.cab https://support.microsoft.com/OAS/ActiveX/odc.cab http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab http://www.symantec.com/techsupp/asa...bs/tgctlsi.cab http://www.symantec.com/techsupp/asa...bs/tgctlsr.cab http://ipgweb.cce.hp.com/rdqnbk/downloads/sysinfo.cab http://catalog.update.microsoft.com/...?1193289794953 http://cdn.scan.safety.live.com/reso...scbase8460.cab http://www.update.microsoft.com/micr...?1188084861203 http://security.symantec.com/sscv6/S.../bin/cabsa.cab http://h20270.www2.hp.com/ediags/gmn...tDetection.cab http://www.update.microsoft.com/micr...?1188084842062 http://pcpitstop.com/mhLbl.cab http://support.f-secure.com/ols/fscax.cab https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx http://ax.emsisoft.com/asquared.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab http://driveragent.com/files/driveragent.cab http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll Ad -Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware\AAWService.exeWlan Service (tiwlnsvc) - Unknown owner - C:\Program Files\WiFire_xp\tiwlnsvc.exe
#10
Member
Profile: Join Date: Jul 2009
Posts: 8
Computer Experience:
Hi again....again -
#11
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 4,707
Computer Experience:
Quote:
Just want to let you know your BBS will not accept Firefox replys
Never heard of it. Using Firefox myself.JavaRa Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions .
Accept any prompts.
Open JavaRa.exe again and select Search For Updates .
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.
Note 1 : UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.Note 2 : The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.Print this post out, since you won't have an access to it, at some point. - R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - (no file) - O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe Fix checked button.
#12
Member
Profile: Join Date: Jul 2009
Posts: 8
Computer Experience:
Hi -HJT log:SP3 (WinNT 5.01.2600)http://www.yahoo.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=74005 http://www.symantec.com http://symantec.atgnow.com/sdccommon...ad/tgctlsi.cab https://support.microsoft.com/OAS/ActiveX/MSDcode.cab http://pcpitstop.com/pcpitstop/PCPitStop.CAB http://downloads.ewido.net/ewidoOnlineScan.cab http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab http://housecall65.trendmicro.com/ho...vex/hcImpl.cab https://support.microsoft.com/OAS/ActiveX/odc.cab http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab http://www.symantec.com/techsupp/asa...bs/tgctlsi.cab http://www.symantec.com/techsupp/asa...bs/tgctlsr.cab http://ipgweb.cce.hp.com/rdqnbk/downloads/sysinfo.cab http://catalog.update.microsoft.com/...?1193289794953 http://cdn.scan.safety.live.com/reso...scbase8460.cab http://www.update.microsoft.com/micr...?1188084861203 http://security.symantec.com/sscv6/S.../bin/cabsa.cab http://h20270.www2.hp.com/ediags/gmn...tDetection.cab http://www.update.microsoft.com/micr...?1188084842062 http://pcpitstop.com/mhLbl.cab http://support.f-secure.com/ols/fscax.cab https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx http://ax.emsisoft.com/asquared.cab http://fpdownload2.macromedia.com/ge...sh/swflash.cab http://driveragent.com/files/driveragent.cab http://utilities.pcpitstop.com/optimize2/pcpitstop2.dll Ad -Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware\AAWService.exeWlan Service (tiwlnsvc) - Unknown owner - C:\Program Files\WiFire_xp\tiwlnsvc.exe
#13
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 4,707
Computer Experience:
Quote:
There were 2 addl Java dowloads in my group. They appearto link to larger installs. Should I install them also?
If you're just an average computer user, then no.Temp File Cleaner (TFC) TFC.exe to run the program.Start button to begin cleaning process.may ask you to restart computer.Windows XP :Windows Vista :Windows Updates are current.6. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately ! WOT (Web OF Trust): http://www.mywot.com/ . It'll warn you (in most cases) about dangerous web sites.How did I get infected?, With steps so it does not happen again! : http://www.bleepingcomputer.com/forums/topic2520.html
#14
Member
Profile: Join Date: Jul 2009
Posts: 8
Computer Experience:
Thank you very much, Broni –
#15
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 4,707
Computer Experience:
You're very welcome
All times are GMT +1. The time now is 04:49 .
