Mobile/PDA About Us Advertise here
User User name Password  
  Not registered yet? Register here.
Lost your password? Click here. 		 
  Home   News   Guides   Downloads   Glossary   Hardware   Profiles   Forums   v4  
 Advertise at AfterDawn.com     Link to us!     Private messages     Compose a private message     List of all updated threads     Threads without replies     Search messages
Saturday 21.12.2024 / 21:45
Search AfterDawn Forums:        In English   Suomeksi   På svenska
afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > why does task manager or rgegedit disappear while opening ?
Show topics
 
Forums
Forums
Why does Task Manager or Rgegedit disappear while opening ?
  Jump to:
 
Posted Message
zucch44
Suspended due to non-functional email address
_ 		28. December 2005 @ 08:20 _ Link to this message    Send private message to this user   
Hi,
I have came across a virus that Symantec could not detect.The symptoms are:
-regedit and task manager closes immediately
-I cannot open McAfee

This is the HijackThis log

Logfile of HijackThis v1.99.1
Scan saved at 19.36.28, on 27/12/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\HPConfig.exe
d:\MSSQL7\binn\sqlservr.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
d:\MSSQL7\binn\sqlagent.exe
C:\WINNT\Explorer.EXE
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\IPM\Adsl\DataWay\dslstat.exe
C:\WINNT\system32\dslagent.exe
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\WINNT\system32\MStools1.exe
D:\MSSQL7\Binn\sqlmangr.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\WINNT\Profiles\hp_xe2\Impostazioni locali\Temporary Internet Files\Content.IE5\S1AF01ER\hijackthis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.it.msn.com/access/allinone.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://it.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Programmi\IPM\Adsl\DataWay\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [Microsoft Service TOols] MStools1.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Windows Locator] locate.exe
O4 - HKLM\..\RunServices: [Microsoft Service TOols] MStools1.exe
O4 - HKLM\..\RunServices: [Windows Locator] locate.exe
O4 - HKCU\..\Run: [Microsoft Service TOols] MStools1.exe
O4 - HKCU\..\Run: [Windows Locator] locate.exe
O4 - HKCU\..\RunServices: [Microsoft Service TOols] MStools1.exe
O4 - HKCU\..\RunServices: [Windows Locator] locate.exe
O4 - Global Startup: Service Manager.lnk = D:\MSSQL7\Binn\sqlmangr.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O13 - WWW. Prefix: http://
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4A52A590-0282-11D1-AA38-00A024FE694D} (USIFirmaJava) - https://online.cariverona.it/nb/applet/JavaFirma.cab
O16 - DPF: {5A52A590-0282-11D1-AA38-00A024FE694D} (USIFirmaDlls) - https://online.cariverona.it/nb/applet/SoftFirma.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptodate.com/vsc/bin/1,0,0,8/McUpdatePortal.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/cl...
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://eu-housecall.trendmicro-europe.com/housecall/applet/html/n...
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4657/mcfs...
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = dismero.it
O17 - HKLM\System\CCS\Services\Tcpip\..\{12D41FBF-F01B-4FB1-ADB0-73AE20F019A3}: NameServer = 194.20.8.1,194.20.8.4
O17 - HKLM\System\CCS\Services\Tcpip\..\{22E7BE19-06FC-4EEE-A27E-04C61B96D0B9}: NameServer = 194.20.8.1,194.20.8.4,194.20.8.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{2AB6CDD3-127E-431C-8458-51C550D94CC5}: NameServer = 213.92.5.54,194.20.8.4
O17 - HKLM\System\CCS\Services\Tcpip\..\{4D76EEEF-2C3C-41E2-8627-B0A310E4853A}: NameServer = 194.20.8.1,194.20.8.4
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = dismero.it
O17 - HKLM\System\CS1\Services\Tcpip\..\{12D41FBF-F01B-4FB1-ADB0-73AE20F019A3}: NameServer = 194.20.8.1,194.20.8.4
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = dismero.it
O17 - HKLM\System\CS2\Services\Tcpip\..\{12D41FBF-F01B-4FB1-ADB0-73AE20F019A3}: NameServer = 194.20.8.1,194.20.8.4
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Programmi\Network Associates\VirusScan\Avsynmgr.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Programmi\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: HP Configuration Service (HPConfig) - Hewlett-Packard - C:\WINNT\System32\HPConfig.exe
O23 - Service: McShield - Unknown owner - C:\Programmi\File comuni\Network Associates\McShield\Mcshield.exe

I have read about a similar log which was sent to you by 'batman187' , but I was not able to understand it because it was written in finnish.

Could you please help me ? Thank you very much !
[ + quote]
-kemisti-
AfterDawn Addict
_ 		28. December 2005 @ 08:58 _ Link to this message    Send private message to this user   
Ok.

First, move HjT into its own folder -> C:\HjT\HijackThis.exe

Then fix with HjT (do a system scan only, mark these and press fix checked):

O4 - HKLM\..\Run: [Microsoft Service TOols] MStools1.exe
O4 - HKLM\..\Run: [Windows Locator] locate.exe
O4 - HKLM\..\RunServices: [Microsoft Service TOols] MStools1.exe
O4 - HKLM\..\RunServices: [Windows Locator] locate.exe
O4 - HKCU\..\Run: [Microsoft Service TOols] MStools1.exe
O4 - HKCU\..\Run: [Windows Locator] locate.exe
O4 - HKCU\..\RunServices: [Microsoft Service TOols] MStools1.exe
O4 - HKCU\..\RunServices: [Windows Locator] locate.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O13 - WWW. Prefix: http://

Then make your hidden and system files visible ->
http://www.xtra.co.nz/help/0,,4155-1916458,00.html

Boot in safe mode (press F8 while booting until you see a menu. Select safe mode from that menu)

Delete these files, if found:

C:\WINNT\system32\==>MStools1.exe<==
C:\WINNT\web\==>related.htm<==
C:\WINNT\system32\==>locate.exe<==

Reboot and send a fresh HjT-log.
[ + quote]
zucch44
Suspended due to non-functional email address
_ 		29. December 2005 @ 04:18 _ Link to this message    Send private message to this user   
Thanks for the detailed writeup: now the problem is solved !

I applicated these tasks:
1. fix with HjT
2. made hidden and system files visible
3. updated my McAfee virus definitions
4. boot in safe mode
5. scanned the system
6. McAfee found the file c:\winnt\system32\MStools1.exe infected by the virus W32/Sdbot.worm.gen.bh
7. delete the file.

Many thanks and happy New Year !

This is the new HjT-log

Logfile of HijackThis v1.99.1
Scan saved at 10.34.03, on 29/12/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\Programmi\Network Associates\VirusScan\Avsynmgr.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\HPConfig.exe
d:\MSSQL7\binn\sqlservr.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
d:\MSSQL7\binn\sqlagent.exe
C:\Programmi\Network Associates\VirusScan\VsStat.exe
C:\Programmi\Network Associates\VirusScan\Avconsol.exe
C:\WINNT\Explorer.EXE
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\IPM\Adsl\DataWay\dslstat.exe
C:\WINNT\system32\dslagent.exe
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
D:\MSSQL7\Binn\sqlmangr.exe
C:\HjT\hijackthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.it.msn.com/access/allinone.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://it.msn.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Programmi\IPM\Adsl\DataWay\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - Global Startup: Service Manager.lnk = D:\MSSQL7\Binn\sqlmangr.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4A52A590-0282-11D1-AA38-00A024FE694D} (USIFirmaJava) - https://online.cariverona.it/nb/applet/JavaFirma.cab
O16 - DPF: {5A52A590-0282-11D1-AA38-00A024FE694D} (USIFirmaDlls) - https://online.cariverona.it/nb/applet/SoftFirma.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptodate.com/vsc/bin/1,0,0,8/McUpdatePortal.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/cl...
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://eu-housecall.trendmicro-europe.com/housecall/applet/html/n...
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4657/mcfs...
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = dismero.it
O17 - HKLM\System\CCS\Services\Tcpip\..\{12D41FBF-F01B-4FB1-ADB0-73AE20F019A3}: NameServer = 194.20.8.1,194.20.8.4
O17 - HKLM\System\CCS\Services\Tcpip\..\{22E7BE19-06FC-4EEE-A27E-04C61B96D0B9}: NameServer = 194.20.8.1,194.20.8.4,194.20.8.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{2AB6CDD3-127E-431C-8458-51C550D94CC5}: NameServer = 213.92.5.54,194.20.8.4
O17 - HKLM\System\CCS\Services\Tcpip\..\{4D76EEEF-2C3C-41E2-8627-B0A310E4853A}: NameServer = 194.20.8.1,194.20.8.4
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = dismero.it
O17 - HKLM\System\CS1\Services\Tcpip\..\{12D41FBF-F01B-4FB1-ADB0-73AE20F019A3}: NameServer = 194.20.8.1,194.20.8.4
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = dismero.it
O17 - HKLM\System\CS2\Services\Tcpip\..\{12D41FBF-F01B-4FB1-ADB0-73AE20F019A3}: NameServer = 194.20.8.1,194.20.8.4
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Programmi\Network Associates\VirusScan\Avsynmgr.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Programmi\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Servizio amministrativo di Gestione disco logico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: HP Configuration Service (HPConfig) - Hewlett-Packard - C:\WINNT\System32\HPConfig.exe
O23 - Service: McShield - Unknown owner - C:\Programmi\File comuni\Network Associates\McShield\Mcshield.exe
[ + quote]
Advertisement
_ 		__
 
_
-kemisti-
AfterDawn Addict
_ 		29. December 2005 @ 04:26 _ Link to this message    Send private message to this user   
Your HjT-log is clean. And happy new year to you, too :)
[ + quote]
afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > why does task manager or rgegedit disappear while opening ?
 

Digital video: AfterDawn.com | AfterDawn Forums
Music: MP3Lizard.com
Gaming: Blasteroids.com | Blasteroids Forums | Compare game prices
Software: Software downloads
Blogs: User profile pages
RSS feeds: AfterDawn.com News | Software updates | AfterDawn Forums
International: AfterDawn in Finnish | AfterDawn in Swedish | AfterDawn in Norwegian | download.fi
Navigate: Search | Site map
About us: About AfterDawn Ltd | Advertise on our sites | Rules, Restrictions, Legal disclaimer & Privacy policy
Contact us: Send feedback | Contact our media sales team
 
  © 1999-2024 by AfterDawn Ltd.

  IDG TechNetwork