Thursday 6.3.2025 / 07:54
afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > help: xp sp3 pc infected, browser popups, hijacked, etc. hijackthis log attached
Help: XP SP3 PC infected, Browser popups, hijacked, etc. HIJACKTHIS log attached
alea
Newbie
8. September 2008 @ 20:20 Link to this message
Hi guys,
infected , very grateful for someone to look over the Hijackthis log below... Can't get onto this site with IE or Firefox , only Safari (windows).
URL requests are compromised or blocked.
HijackThis v2.0.2
Starter Edition\3.0\Apps\apdproxy.exe
http://www.google.co.uk/
http://go.microsoft.com/fwlink/?LinkId=69157
http://go.microsoft.com/fwlink/?LinkId=54896
http://go.microsoft.com/fwlink/?LinkId=54896
http://go.microsoft.com/fwlink/?LinkId=69157
http://www1.euro.dell.com/content/default.aspx?c=uk&l=en&s=gen
USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
QuickTime Object) - http://appldnld.apple.com.edgesuite.net/...ex/qtplugin.cab
http://housecall65.trendmicro.com/housec...ivex/hcImpl.cab
http://upload.facebook.com/controls/FacebookPhotoUploader.cab
http://update.microsoft.com/microsoftupd...b?1141773193750
http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
http://static.photobox.co.uk/sg/common/uploader.cab
AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
Advertisement
alea
Newbie
8. September 2008 @ 20:59 Link to this message
Ran Combofix with laptop disconnected from www and AVG + windows firewall and defender disabled... Log:
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2003-09-05 878080]
Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-09-07 97928]
Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 32512]
FireFox -: Profile - C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\52goby2f.default\
Gmer , http://www.gmer.net
Pack 3 NTFS
AfterDawn Addict
9. September 2008 @ 01:40 Link to this message
Hi alea,
Notepad - it must be Notepad, not Wordpad.
Ctrl+C
Quote: Edit > Paste
File > Save
"CFScript.txt" (including the quotes)
CFScript into ComboFix.exe
Combofix.txt in your next reply together with a new HijackThis logYour Java is out of date.
Update Java using JavaRa
JavaRa and unzip it to your desktop.
JavaRa.exe to start the program.
Remove Older Versions to remove the older versions of Java installed on your computer.
Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
pop up. Please save it to a convenient location.
Java Runtime Environment (JRE) 6 Update 7 .
http://www.download.com/Adobe-Reader/3000-2378_4-10000062.html
This message has been edited since posting. Last time this message was edited on 9. September 2008 @ 02:33
alea
Newbie
9. September 2008 @ 13:37 Link to this message
Thanks very much for getting back so fast. Have carried out the Combofix with the script. Here's the logs: (will update Java and Adobe once clean).
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2003-09-05 878080]
Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]
AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-09-07 97928]
Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 32512]
Gmer , http://www.gmer.net
Pack 3 NTFS
HijackThis v2.0.2
http://www.google.co.uk/
http://go.microsoft.com/fwlink/?LinkId=69157
http://go.microsoft.com/fwlink/?LinkId=54896
http://go.microsoft.com/fwlink/?LinkId=54896
http://go.microsoft.com/fwlink/?LinkId=69157
http://www1.euro.dell.com/content/default.aspx?c=uk&l=en&s=gen
QuickTime Object) - http://appldnld.apple.com.edgesuite.net/...ex/qtplugin.cab
http://housecall65.trendmicro.com/housec...ivex/hcImpl.cab
http://upload.facebook.com/controls/FacebookPhotoUploader.cab
http://update.microsoft.com/microsoftupd...b?1141773193750
http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
http://static.photobox.co.uk/sg/common/uploader.cab
AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
AfterDawn Addict
9. September 2008 @ 14:53 Link to this message
@ alea,
download the OTMoveIt2 by OldTimer .
Save it to your desktop .
OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator ).
Copy the lines in the box below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy ):
Quote: "Paste List of Files/Folders to Move" window (under the Yellow bar) and choose Paste .
Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
OTMoveIt2
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
This message has been edited since posting. Last time this message was edited on 9. September 2008 @ 14:57
alea
Newbie
10. September 2008 @ 13:33 Link to this message
@2OG
AfterDawn Addict
10. September 2008 @ 15:26 Link to this message
Congratulations alea, your log now looks CLEAN Here are a few other things you must do once you are completely clean: 1. Time for some housekeeping
download the OTMoveIt2 by OldTimer
Save it to your desktop.
Run the tool by clicking on the icon.
Cleanup button.
2. Please download ATF Cleaner by Atribune.
ATF-Cleaner.exe to run the program.
Main "Select Files to Delete " choose: Select All.
Empty Selected button.
Firefox browser click Firefox at the top and choose: Select All
Empty Selected button.
No at the prompt.
Opera browser click Opera Select All
Empty Selected button.
No at the prompt.
Exit on the Main menu to close the program.
3. Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. A malicious site could render Java content under older, vulnerable versions of Sun's software if the user has not removed them. Please follow these steps to remove older version Java components and update:
JavaRa and unzip it to your desktop.
JavaRa.exe to start the program.
Remove Older Versions to remove the older versions of Java installed on your computer.
Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
pop up. Please save it to a convenient location.
Java Runtime Environment (JRE) 6 Update 7 .
4. Now Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.
The easiest and safest way to do this is:
Start > Programs > Accessories > System Tools and click "System Restore ".
Create a Restore Point " on the first screen then click "Next ". Give the R.P. a name then click "Create ". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
Start > Run and type: Cleanmgr
OK "
C:
OK
More Options " Tab.
Clean Up " in the System Restore section to remove all previous restore points except the newly created one.
5. Defragment your Hard Drive
Properties.
Defragment Now.
Defragment.
And here are some tips to reduce the potential for spyware infection in the future: firewall to protect your computer from hackers. We don't recommend the firewall that comes built in to Windows. It doesn't block everything that may try to get in, and the entire firewall is written to the registry. As various kinds of malware hack the Registry in order to disable the Windows firewall, it's far preferable to install one of the excellent third party solutions. Two good ones are are Comodo Free and Online Armor Personal Firewall
Make sure you keep your Windows OS current Windows update
I strongly recommend installing the following applications:
In order to prevent the installation of Trojans and Malware on your machine: Comodo BOClean
Comodo BOClean protects your computer against trojans, malware and other threats. It constantly scans your system in the background and intercepts any recognized trojan activity. The program can ask the user what to do, or run in unattended mode and automatically shutdown and remove any suspected trojan application. Comodo BOClean currently supports more than 59000 malware items and offers automatic daily updates. Other features include updating via network share, tamper protection and stealth mode.
Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know Malware sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.
So how did I get infected in the first place?
This message has been edited since posting. Last time this message was edited on 10. September 2008 @ 15:29
alea
Newbie
10. September 2008 @ 18:04 Link to this message
@2oldGeek,
Advertisement
AfterDawn Addict
10. September 2008 @ 18:10 Link to this message
You're welcome.
M8
afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > help: xp sp3 pc infected, browser popups, hijacked, etc. hijackthis log attached
