| Forum Home | ||||
| Press F1 | ||||
| Thread ID: 65464 | 2006-01-19 02:48:00 | Ctrl/Alt/Del | Thomas01 (317) | Press F1 |
| Post ID | Timestamp | Content | User | ||
| 422411 | 2006-01-19 08:06:00 | I would give the machine a good hot scrub. Check out the FAQs. PS yes Terry Porrit ,that's where I got it from. But I suppose it was in use in that area and epoch in britland. |
mark c (247) | ||
| 422412 | 2006-01-19 08:24:00 | Regedit - I tried it and it doesn't work. Neither does Ctrl/Shift/Esc I enclose the log asked for Logfile of HijackThis v1.99.1 Scan saved at 9:14:03 p.m., on 19/01/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\UAService7.exe C:\WINDOWS\system32\fxssvc.exe C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe C:\Program Files\VIA Technologies, Inc\Audio Deck\ADeck.exe C:\Program Files\Common Files\Logitech\QCDriver2\LVCOMS.EXE C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Picassa2\Picasa2\PicasaMediaDetector.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\WINDOWS\system32\anti_troj.exe C:\WINDOWS\system32\winlog.exe C:\program files\Microsoft Money\System\reminder.exe C:\WINDOWS\system32\anti_troj.exe C:\WINDOWS\system32\winlog.exe C:\Program Files\MiniMind\MiniMind.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\totalcmd\TOTALCMD.EXE C:\WINDOWS\system32\SNDVOL32.EXE C:\DOCUME~1\Tom\LOCALS~1\Temp\_tc0\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIA Technologies, Inc\Audio Deck\ADeck.exe O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver2\LVCOMS.EXE O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SchedulingAgent] mstinit.exe /firstlogon O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picassa2\Picasa2\PicasaMediaDetector.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" O4 - HKLM\..\Run: [anti_troj] C:\WINDOWS\system32\anti_troj.exe O4 - HKLM\..\Run: [key2] C:\WINDOWS\system32\winlog.exe O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKCU\..\Run: [Reminder] C:\program files\Microsoft Money\System\reminder.exe O4 - HKCU\..\Run: [anti_troj] C:\WINDOWS\system32\anti_troj.exe O4 - HKCU\..\Run: [key2] C:\WINDOWS\system32\winlog.exe O4 - Startup: MiniMinder.lnk = C:\Program Files\MiniMind\MiniMind.exe O4 - Global Startup: Adobe Gamma Loader.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {FA83E942-B796-46DE-9155-1632ECC5473B} - akamai.downloadv3.com O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe I will not do anything else until I get a reply etc. Tom |
Thomas01 (317) | ||
| 422413 | 2006-01-19 08:37:00 | You can decipher your HijackThis log at this website: www.hijackthis.de Cheers :) |
Renmoo (66) | ||
| 422414 | 2006-01-19 08:42:00 | ......or wait for super Speedy Gonzales, who is an ace at interpreting HJT logs. | mark c (247) | ||
| 422415 | 2006-01-19 08:48:00 | Yup, u have a trojan horse . Namely this ( . symantec . com/avcenter/venc/data/trojan . lodear . e . html" target="_blank">securityresponse . symantec . com) or one of its variants . Boot into safe mode, and turn system restore OFF . Follow the instructions on the above site . Run HJT again and tick these entries and tick fix checked C:\WINDOWS\system32\anti_troj . exe C:\WINDOWS\system32\anti_troj . exe And this command is whats causing the prob . O4 - HKLM\ . . \Run: [anti_troj] C:\WINDOWS\system32\anti_troj . exe O4 - HKCU\ . . \Run: [anti_troj] C:\WINDOWS\system32\anti_troj . exe O16 - DPF: {FA83E942-B796-46DE-9155-1632ECC5473B} - . downloadv3 . com/binari . . . ESS_1061_XP . cab" target="_blank">akamai . downloadv3 . com You dont need these on bootup O4 - HKLM\ . . \Run: [KernelFaultCheck] %systemroot%system32\dumprep 0 -k O4 - HKLM\ . . \Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask . exe" -atboottime O4 - HKLM\ . . \Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck . exe O4 - HKLM\ . . \Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1 . 4 . 2_05\bin\jusched . exe - Update this . Uninstall this version first . Download the latest version from here ( . java . com:80/en/download/manual . jsp" target="_blank">www . java . com:80) (The Windows offline install link - 16 mb) . O4 - HKLM\ . . \Run: [nwiz] nwiz . exe /install O4 - HKLM\ . . \Run: [NvMediaCenter] RUNDLL32 . EXE C:\WINDOWS\System32\NvMcTray . dll,NvTaskbarInit Do you know what this is / belongs to? C:\Program Files\MiniMind\MiniMind . exe O4 - Startup: MiniMinder . lnk = C:\Program Files\MiniMind\MiniMind . exe And install a firewall . It doesnt look like you've got one installed . |
Speedy Gonzales (78) | ||
| 422416 | 2006-01-19 19:47:00 | This entry doesnt have to be in startup either O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" Unless you've got a remote control for it. |
Speedy Gonzales (78) | ||
| 422417 | 2006-01-19 22:32:00 | Amazing really. I followed the advice given and rebooted to get into safe mode and do all the very complicated stuff that I was dreading. But I was distracted for a moment and missed the safe mode and ended up with an ordinary boot. This time there was a MS message - WINXP had found I had a Trojan horse program and had removed it. There was even a link to read all about it (which shocked me somewhat when I read it). But now everything worked well and no problems any longer. When I think of all the times I have cursed MS and its obsession with security I felt really awful. Sorry Bill G. I love you and all of MS Tom |
Thomas01 (317) | ||
| 422418 | 2006-01-20 01:13:00 | Try reinstalling windows, that happend to me before, | Sync_88k (9584) | ||
| 422419 | 2006-01-20 01:26:00 | H. E. Bates was an exceedingly fine English novellist, who wrote a series of books about the Larkin family set in rural England. "Perfick" was an expression used by 'Pop' Larkin. A television series called The Darling Buds of May was based on these books : www.televisionheaven.co.uk Isn't the phonetic spelling puffick? |
Graham L (2) | ||
| 422420 | 2006-01-26 17:55:00 | Oh! It is look like u have problem with Speicher. |
Fler (88) | ||
| 1 2 3 4 | |||||