Sunday 7.9.2025 / 12:32
afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > hjt log. computer in critical stage. please help!
HJT Log. Computer in Critical stage. Please Help!
Reitfor
Suspended due to non-functional email address
19. August 2007 @ 06:58 Link to this message
Here is the Log, please someone take a look.
HijackThis v1.99.1
Internet Explorer v6.00 SP2 (6.00.2900.2180)
http://myspace.com/
http://www.dell.com
Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
HP - C:\WINDOWS\system32\HPZipm12.exe
Firmware Database: Psp-TA-082>2.71>3.11 changed 2.00>1.5>3.10OE-A>3.30OE-A>1.5>3.30OE-A>1.5>3.40OE-A
Advertisement
Insorak
Suspended due to non-functional email address
19. August 2007 @ 07:34 Link to this message
Let's get a close look at your system. Please download Deckard's System Scanner (formerly ComboScan) from the link provided. Save it to your Desktop.
Note: This program will clear your temporary files.
HijackThis on your computer, it will prompt you to look for it. Please press "yes" and tell the scanner where it is located. If the scanner asks you to download HijackThis , please answer "yes" to that as well. During the scan, your firewall may warn you about a .exe file attempting to connect to the Internet; please allow it. Your antivirus may also detect Deckard's System Scanner as a Possible Threat or RiskTool; it may be better for you to temporarily disable your antivirus.
two logfiles for you: a "main.txt" (which you see) and an "extra.txt" (which is minimized). Please copy the contents of both these logfiles into your next reply.
Reitfor
Suspended due to non-functional email address
19. August 2007 @ 11:02 Link to this message
Here you go, thanks.
Total Physical Memory: 248 MiB (512 MiB recommended).
HijackThis (run as Konnichiwa!!!.exe) ---------------------------------------
HijackThis v1.99.1
Internet Explorer v6.00 SP2 (6.00.2900.2180)
http://myspace.com/
http://www.dell.com
Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
HP - C:\WINDOWS\system32\HPZipm12.exe
2600 ) SP 2.0
Firewall is disabled.
Outdated
(admin)
(guest)
HijackThis 1.99.1 --> C:\Documents and Settings\Konnichiwa!!!\Desktop\HijackThis.exe /uninstall
RealPlayer Basic --> C:\Program Files\Common Files\Real\Update\\rnuninst.exe RealNetworks|RealPlayer|6.0
WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
Firmware Database: Psp-TA-082>2.71>3.11 changed 2.00>1.5>3.10OE-A>3.30OE-A>1.5>3.30OE-A>1.5>3.40OE-A
Reitfor
Suspended due to non-functional email address
19. August 2007 @ 17:32 Link to this message
Did you saw the logs? Whats wrong?
Firmware Database: Psp-TA-082>2.71>3.11 changed 2.00>1.5>3.10OE-A>3.30OE-A>1.5>3.30OE-A>1.5>3.40OE-A
Reitfor
Suspended due to non-functional email address
21. August 2007 @ 17:55 Link to this message
Can someone please take a look at this?
Firmware Database: Psp-TA-082>2.71>3.11 changed 2.00>1.5>3.10OE-A>3.30OE-A>1.5>3.30OE-A>1.5>3.40OE-A
hilu
Junior Member
22. August 2007 @ 09:43 Link to this message
Download ComboFix from
Here Here combofix.exe and follow the prompts.
HiJackthis Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Reitfor
Suspended due to non-functional email address
22. August 2007 @ 16:22 Link to this message
Um if you didn't noticed that was combofix just now...
Firmware Database: Psp-TA-082>2.71>3.11 changed 2.00>1.5>3.10OE-A>3.30OE-A>1.5>3.30OE-A>1.5>3.40OE-A
Member
22. August 2007 @ 18:28 Link to this message
That was Deckard's System Scanner - a different tool from ComboFix. While they scan roughly the same things, DSS does not fix anything.
Geeks to Go - Trusted Helper
Reitfor
Suspended due to non-functional email address
24. August 2007 @ 01:40 Link to this message
Where is the Log of Combofix and how long is it?
Firmware Database: Psp-TA-082>2.71>3.11 changed 2.00>1.5>3.10OE-A>3.30OE-A>1.5>3.30OE-A>1.5>3.40OE-A
Member
24. August 2007 @ 09:40 Link to this message
Uhh... the log of combofix is made after you scan with it?
Geeks to Go - Trusted Helper
Reitfor
Suspended due to non-functional email address
24. August 2007 @ 13:57 Link to this message
Umm would you kindly explain to me where exactly? Cause it wasnt in the desktop, there was this little text in the Combofix folder but it didnt contained two to four lines.
Firmware Database: Psp-TA-082>2.71>3.11 changed 2.00>1.5>3.10OE-A>3.30OE-A>1.5>3.30OE-A>1.5>3.40OE-A
hilu
Junior Member
25. August 2007 @ 00:21 Link to this message
it's suppoused find here:
Reitfor
Suspended due to non-functional email address
25. August 2007 @ 03:30 Link to this message
Hope this helps:
HJT Log:
HijackThis v1.99.1
Internet Explorer v6.00 SP2 (6.00.2900.2180)
http://myspace.com/
Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
HP - C:\WINDOWS\system32\HPZipm12.exe
Firmware Database: Psp-TA-082>2.71>3.11 changed 2.00>1.5>3.10OE-A>3.30OE-A>1.5>3.30OE-A>1.5>3.40OE-A
hilu
Junior Member
25. August 2007 @ 22:36 Link to this message
Hi,
HiJackThis clic "do a system scan only" and checkmark:
SDFix and save it to your Desktop.
Double click
SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)
Please then reboot your computer in
Safe Mode by doing the following :
* Restart your computer
* After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
* Instead of Windows loading as normal, the Advanced Options Menu should appear;
* Select the first option, to run Windows in Safe Mode, then press
Enter .
* Choose your usual account.
* Open the extracted SDFix folder and double click
RunThis.bat to start the script.
* Type
Y to begin the cleanup process.
* It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
* Press any Key and it will restart the PC.
* When the PC restarts the Fixtool will run again and complete the removal process then display
Finished , press any key to end the script and load your desktop icons.
* Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as
Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
* Finally paste the contents of the Report.txt back on the forum with a new
HijackThis log
---------------------------------------------------------------
Download ComboFix from
Here or
Here to your Desktop.
* Double click
combofix.exe and follow the prompts.
* When finished, it shall produce a log for you. Post that log and a
HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall post:
Fresh HiJackThis log
Report.txt
C:\combofix.txt
Reitfor
Suspended due to non-functional email address
26. August 2007 @ 06:46 Link to this message
All is here:
d-------- C:\WINDOWS\ERUNT
d-------- C:\Deckard
d-------- C:\VundoFix Backups
Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2006-04-06 15:58]
Gmer , http://www.gmer.net
HJT LOG:
HijackThis v1.99.1
Internet Explorer v6.00 SP2 (6.00.2900.2180)
http://myspace.com/
Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
HP - C:\WINDOWS\system32\HPZipm12.exe
Firmware Database: Psp-TA-082>2.71>3.11 changed 2.00>1.5>3.10OE-A>3.30OE-A>1.5>3.30OE-A>1.5>3.40OE-A
hilu
Junior Member
26. August 2007 @ 07:45 Link to this message
This message has been edited since posting. Last time this message was edited on 26. August 2007 @ 08:20
Reitfor
Suspended due to non-functional email address
26. August 2007 @ 16:28 Link to this message
File: cmdstp.exe
AVG Antivirus Found Downloader.Generic4.TGE
Kaspersky Anti-Virus Found Trojan-Clicker.Win32.Agent.jn
Firmware Database: Psp-TA-082>2.71>3.11 changed 2.00>1.5>3.10OE-A>3.30OE-A>1.5>3.30OE-A>1.5>3.40OE-A
hilu
Junior Member
27. August 2007 @ 02:45 Link to this message
Hi
Download and Run Killbox Killbox .
Delete on Reboot " and "All files "
Quote: Paste from Clipboard
Delete File button. Click Yes at the Delete on Reboot prompt. Click No at the Pending Operations prompt.
If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click [url=http://www.eudaemonia.me.uk/downloads/Files/missingfilesetup.exe][color=blue]here[/color][/url] to download and run missingfilesetup.exe. Then try TheKillbox again.
ATF Cleaner ATF-Cleaner.exe to run the program.
* Under Main choose: Select All
* Click the
Empty Selected button.
If you use
Firefox browser
* Click
Firefox at the top and choose: Select All
* Click the Empty Selected button.
*
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use
Opera browser
* Click
Opera at the top and choose: Select All
* Click the Empty Selected button.
*
NOTE: If you would like to keep your saved passwords, please click No at the prompt.[/list]
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.
This will remove all files from the items that are checked so if you have some cookies you'd like to save. please move them to a different directory first.
Please download
AVG Anti-Spyware to your Desktop or to your usual Download Folder.
* Install
AVG Anti-Spyware by double clicking the installer.
* Follow the prompts. Make sure that
Launch AVG Anti-Spyware is checked.
* On the main screen under
Your Computer's security .
* Click on
Change state next to
Resident shield . It should now change to
inactive .
* Click on
Change state next to
Automatic updates . It should now change to
inactive .
* Next to
Last Update , click on
Update now . (You will need an active internet connection to perform this)
* Wait until you see the Update succesfull message.
* Right-click the AVG Anti-Spyware Tray Icon and uncheck
Start with Windows .
* Right-click the AVG Anti-Spyware Tray Icon and select
Exit . Confirm by clicking
Yes .
If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates .
Download the
Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
Reboot your computer in
Safe Mode .
* If the computer is running, shut down Windows, and then turn off the power.
* Wait 30 seconds, and then turn the computer on.
* Start tapping the
F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
* Ensure that the
Safe Mode option is selected.
* Press
Enter . The computer then begins to start in Safe mode.
* Login on your usual account.
Once in Safe Mode:
Close
ALL open Windows / Programs / Folders. Please start
AVG Anti-Spyware and run a full scan.
* Click on
Scanner on the toolbar.
* Click on the
Settings tab.
* Under
How to act?
* Click on
Recommended Action and choose
Quarantine from the popup menu.
* Under
How to scan?
* All checkboxes should be ticked.
* Under
Possibly unwanted software:
* All checkboxes should be ticked.
* Under
Reports:
* Select
Automatically generate report after every scan and uncheck
Only if threats were found .
* Under
What to scan?
* Select
Scan every file .
* Click on the
Scan tab.
* Click on
Complete System Scan to start the scan process.
* Let the program scan the machine.
* When the scan has finished, follow the instructions below.
IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button. * Make sure that
Set all elements to: shows
Quarantine (1) , if not click on the link and choose
Quarantine from the popup menu.
(2) *At the bottom of the window click on the
Apply all Actions button.
(3) * When done, click the
Save Scan Report button.
(4) *Click the
Save Report as button.
* Save the report to your Desktop.
* Right-click the AVG Anti-Spyware Tray Icon and select
Exit . Confirm by clicking
Yes .
Reboot back into Normal Mode
Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update. * Download the latest version of
Java(TM) SE Runtime Environment 6u2 * Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
* Click the "Download" button to the right.
* Check
the box that says: "Accept License Agreement".
* The page will refresh.
* Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
* Close any programs you may have running - especially your web browser.
* Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
* Check any item with Java Runtime Environment (JRE or J2SE) in the name.
* Click the Remove or Change/Remove button.
* Repeat as many times as necessary to remove each Java versions.
* Reboot your computer once all Java components are removed.
* Then from your desktop double-click on the download to install the newest version.
Download
Deckard's System Scanner (DSS) to your
Desktop .
Note: You must be logged onto an account with administrator privileges.
*
Close all applications and windows.
*
Double-click on
dss.exe to run it, and follow the prompts.
* When the scan is complete, two text files will open -
main.txt <- this one will be maximized and
extra.txt <-this one will be minimized
* Copy
(Ctrl+A then Ctrl+C) and paste
(Ctrl+V) the contents of
main.txt and the extra.txt to your post. in your reply
post:
AVG Anti-Spyware log
main.txt
extra.txt
This message has been edited since posting. Last time this message was edited on 27. August 2007 @ 10:58
Advertisement
Reitfor
Suspended due to non-functional email address
28. August 2007 @ 02:36 Link to this message
Umm I forgot to put the AVG cause I forgot to make it, but I know that there were 4 High Risk: Hijack,Backdoor,Proxy and another one I dont remember now, and there were also 21 mediums that were deleted. Here is DSS Log:
Percentage of Memory in Use: 90% (more than 75%).
Total Physical Memory: 248 MiB (512 MiB recommended).
HijackThis Clone ------------------------------------------------------------
HijackThis v1.99.1
Internet Explorer (6.00.2900.2180)
http://myspace.com/
http://www.google.com/ie
http://www.google.com/search?q=%s
http://www.google.com/ie
http://www.google.com/ig/dell?hl=en&client=dell-inc&channel=us
http://fpdownload.macromedia.com/pub/sho...director/sw.cab
http://fpdownload.macromedia.com/get/fla...ent/swflash.cab
Ad-Aware 2007 Service (aawservice) - Lavasoft AB - "C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe"
Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
Dell Inc. - C:\Program Files\Dell\QuickSet\NicConfigSvc.exe
HP - C:\WINDOWS\system32\HPZipm12.exe
2600 ) SP 2.0
Firewall is enabled.
Outdated
(admin)
(guest)
AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
HijackThis 1.99.1 --> C:\Documents and Settings\Konnichiwa!!!\Desktop\HijackThis.exe /uninstall
Mozilla Firefox (2.0.0.6) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
WinRAR archiver --> C:\Program Files\WinRAR\uninstall.exe
Firmware Database: Psp-TA-082>2.71>3.11 changed 2.00>1.5>3.10OE-A>3.30OE-A>1.5>3.30OE-A>1.5>3.40OE-A
afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > hjt log. computer in critical stage. please help!
