Login | Live Chat & Podcast at 1:00PM Eastern on Sunday! |
 Search | |
| |
15-Mar-2005, 05:49 AM
#16 | |||||
|
__________________ Are you at risk from Hepatitis C ? Want to know how your computer got infected and how to help prevent it? HERE Member of "ASAP" The Alliance of Security Analysis Professionals and Microsoft MVP Security |
| |
15-Mar-2005, 07:42 AM
#19 | |||||
| This is fun aint it?    About as much fun as placing your wedding tackle into a lions mouth and flicking its love spuds with a wet towel. You have almost a full house of the latest crapware!......VX2.....is bad enough as its a magnet for lots more.But you also have Bube.d aka Win32.Beavis which is a new infection that also is responsible for downloading more and more of this garbage on to your computer.It looks like its going to need removing first,as its stopping the full cleaning of the VX2 infection The only program we have found so far that removes it properly(Thanx to CalamityJane) is KAV Personal 5.0 (you can get a free 30 day trial, fully functional that will remove it for you). Im going to give you a link to very detailed instructions on how to remove this pest............until we get you clean its VERY important that you stay off the net apart from these forums. Disable your antivirus program and follow CJ`s instructions......you wont be able to post anything in the thred,as its been closed but I will be around here to help with anything.Then we can remove the VX2 and the rest of the malware for you here at TSG. Heres the link: http://forum.gladiator-antivirus.com...=23364&hl=bube Good luck. 
__________________ Are you at risk from Hepatitis C ? Want to know how your computer got infected and how to help prevent it? HERE Member of "ASAP" The Alliance of Security Analysis Professionals and Microsoft MVP Security Last edited by $teve; 15-Mar-2005 at 11:49 AM.. |
16-Mar-2005, 03:33 PM
#25 | |||||
| Dont panic.............I can see the reason why you cant connect......it also means your not "collecting" any more bogies. ==================================== Put a checkmarrk next to these entries with HijackThis and hit "FIX": R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O1 - Hosts: 69.20.16.183 auto.search.msn.com O1 - Hosts: 69.20.16.183 search.netscape.com O1 - Hosts: 69.20.16.183 ieautosearch O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDT/ie/bridge-c18.cab O16 - DPF: {A5F09500-01B0-4930-B62E-7A86D8311411} (EasyMessengerInstaller Class) - http://fad-413.mtl4.targetnet.com/a...MessengerAX.cab O16 - DPF: {B4831DED-3A57-4CC6-9E4B-0E7C5B08DBF4} - http://www.alwaysupdatednews.com/install/aun_0032.exe O16 - DPF: {EB623776-492A-42CA-9571-3AA39F58530B} - http://www.alwaysupdatednews.com/install/aun_0029.exe O18 - Filter: text/html - {DFAA31C8-A356-4313-9D95-5EDAB46C5070} - C:\WINDOWS1\system32\lmf32v.dll O20 - Winlogon Notify: Explorer - C:\WINDOWS1\system32\ktlql7351.dll (file missing) ==================================== Click Start -> Control Panel -> Add/Remove Programs Scroll to Media Access and click Remove ==================================== You will have to download a few things to floppy and run on the infected machine. ===================================== Download and run this to fix your winsock settings. http://www.spychecker.com/program/winsockxpfix.html ===================================== Download killbox http://www.downloads.subratam.org/KillBox.exe We may have to use this later. ===================================== Download "DllCompare"..its the 1st item on this page. http://forums.subratam.org/index.php?showtopic=1725 Copy the dllcompare.exe to your desktop, don't just run it from the download site. it is preset to scan the System32 directory, so nothing other than you clicking the [Run locate.com] button is required. When the scan is complete, you will see in blue Completed the scan, Click Compare to Continue at which time you will click the [Compare] button. It will sort through the files it found and determine which should be flagged as "No access" and display them in the lower box. In a few minutes it will complete *in blue Completed Click the button [Make a Log of what was Found] Post that log here along with a shiny new Hijack log please. 
__________________ Are you at risk from Hepatitis C ? Want to know how your computer got infected and how to help prevent it? HERE Member of "ASAP" The Alliance of Security Analysis Professionals and Microsoft MVP Security Last edited by $teve; 16-Mar-2005 at 04:21 PM.. |
17-Mar-2005, 12:38 AM
#26 | |||||
| Here's the DllCompare log... * DLLCompare Log version(1.0.0.127) Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ O^E says: "There were no files found  "________________________________________________ 1,223 items found: 1,223 files, 0 directories. Total of file sizes: 257,753,295 bytes 245.81 M Administrator Account = True --------------------End log--------------------- ...and the new Hijack log... Logfile of HijackThis v1.99.1 Scan saved at 8:37:37 PM, on 3/16/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS1\System32\smss.exe C:\WINDOWS1\system32\winlogon.exe C:\WINDOWS1\system32\services.exe C:\WINDOWS1\system32\lsass.exe C:\WINDOWS1\system32\svchost.exe C:\WINDOWS1\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS1\system32\spoolsv.exe C:\Program Files\Symantec AntiVirus\DefWatch.exe C:\WINDOWS1\System32\nvsvc32.exe C:\WINDOWS1\System32\svchost.exe C:\Program Files\Symantec AntiVirus\Rtvscan.exe C:\WINDOWS1\Explorer.EXE C:\WINDOWS1\system32\devldr32.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Collin Cordoza\Desktop\DllCompare.exe C:\WINDOWS1\system32\NOTEPAD.EXE C:\Program Files\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bus.orst.edu/ O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS1\system32\NvCpl.dll,NvStartup O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS1\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS1\system32\HPZipm12.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe ...what next doc? |
17-Mar-2005, 05:16 PM
#30 | |||||
| Open regedit............"Start" < "Run" Type "Regedit" (without the " " )Double click your way to: HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Setting\Zones\2, Change the value named "Flag" to decimal value 71. To change the value....right click on the entry "Flag" and choose "Modify" you will see a pane "Edit Word Value",put a check in "Decimal" and then change the value data to 71 Do the same for the HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Setting\Zones\2 You can now edit the trusted security zones in IE and set them back to default. You will want to click on each zone and restore default and also check each zones Sites button to make sure all sites are removed. Download and run this: http://windowsxp.mvps.org/IEFIX.htm Internet Explorer Fix is a general purpose repair utility for Internet Explorer which repairs Internet Explorer by registering it's core DLL files and through the INF file. Additionally if it detects Windows 2000/XP as the Operating System, it runs SFC to restore missing or corrupt Windows system files. You may also need to uninstall/reinstall SP2 ========================================== Im attaching a reg file (fixreg.zip) Download it, unzip it and double click on FixReg.reg to merge with your registry. Answer *ok* That should repair Windows Update. You will see it at the bottom of this post. ========================================== Now....for the prevention. Read up here: http://forums.techguy.org/t208517.html =================================== A few free programs to start you off. SpywareBlaster v 3.0 and SpywareGuard v2.2, to prevent Active-X drive-by installations, as well as provide real-time browser hijacking protection: http://www.wilderssecurity.net/index.html IE-SPYAD, a registry file that adds a long list of known "sites" to the Restricted Sites of your Internet Explorer: https://netfiles.uiuc.edu/ehowes/www/resource.htm You should check regularly for updates on all these programs Mozilla FireFox,much safer,faster and lighter browser than IE. http://www.mozilla.org/products/firefox/ . Install 'Spoofstick" Spoofstick is a simple browser extension that helps users detect spoofed (fake) websites. This extension is free and installs in Internet Explorer and Mozilla Firefox. a. http://www.corestreet.com/spoofstick Ill still be around so if you have any more questions or problems let me know.
__________________ Are you at risk from Hepatitis C ? Want to know how your computer got infected and how to help prevent it? HERE Member of "ASAP" The Alliance of Security Analysis Professionals and Microsoft MVP Security |
 |
| |
| Currently Active Users Viewing This Thread: 1 (0 members and 1 guests) | |
| Thread Tools | |
| |
| You Are Using:  |
Advertisements do not imply our endorsement of that product or service. All times are GMT -4. The time now is 05:33 PM. Copyright © 1996 - 2011 TechGuy, Inc. All rights reserved. |  |
Facebook
Twitter
TechGuy.tv
TSG Mobile