1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Viruses, Trojans and Spyware.

Discussion in 'Virus & Other Malware Removal' started by BOILED.frogs__, Jul 14, 2007.

Thread Status:
Not open for further replies.
Advertisement
  1. BOILED.frogs__

    BOILED.frogs__ Thread Starter

    Joined:
    Jul 14, 2007
    Messages:
    82
    Can someone help me out here?
    Ive had my PC for over a year now. It was custom built by an IT professional. Which was fantastic because I got it for free. I got free MS Office, free Photoshop, free Anit-Virus and I guess you get the picture.

    But Im quiet concerned about something.
    I update my anti-virus regularly, I have automatic updates turned on, I have Windows Firewall and ZoneAlarm firewall protecting my computer & Im generally careful with what I do online (well not exactly, read on and find out why)
    Im guilty of using p2p clients, I used to download whatever I thought was interesting of the net and having my firewall turned off and my updates turned off.

    Enough chit chat, now Ill tell you what im concerned about.
    I have never gotten any notification of viruses, Trojans or spyware when I know its there. My virus scan hasn't given any sign of viruses, I haven't received any notifications and Ive sent people files and they have said there was nothing in them.

    Could someone help me out?
    Because I know they're there.

    Thanks in advance and any type of information could be helpful.
     
  2. Cheeseball81

    Cheeseball81 Retired Moderator

    Joined:
    Mar 3, 2004
    Messages:
    84,315
    Hi and welcome :)


    * Click here to download HJTsetup.exe.
    Save HJTsetup.exe to your desktop.

    Double click on the HJTsetup.exe icon on your desktop.
    By default it will install to C:\Program Files\Hijack This.
    Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
    Put a check by Create a desktop icon then click Next again.
    Continue to follow the rest of the prompts from there.
    At the final dialogue box click Finish and it will launch Hijack This.
    Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
    Click Save to save the log file and then the log will open in notepad.
    Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
    Come back here to this thread and Paste the log in your next reply.
    DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
     
  3. BOILED.frogs__

    BOILED.frogs__ Thread Starter

    Joined:
    Jul 14, 2007
    Messages:
    82
    Im setting up HJT as we speak but I did a SuperAntiSpyware scan and heres my log

    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 07/15/2007 at 00:55 AM

    Application Version : 3.9.1008

    Core Rules Database Version : 3269
    Trace Rules Database Version: 1280

    Scan type : Quick Scan
    Total Scan Time : 00:34:55

    Memory items scanned : 463
    Memory threats detected : 4
    Registry items scanned : 616
    Registry threats detected : 68
    File items scanned : 16374
    File threats detected : 16

    Trojan.NewDotNet-Installer
    C:\PROGRAM FILES\NEWDOTNET\NEWDOTNET7_48.DLL
    C:\PROGRAM FILES\NEWDOTNET\NEWDOTNET7_48.DLL
    C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL
    C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL

    RelevantKnowledge Spyware Component
    C:\WINDOWS\SYSTEM32\RLVKNLG.EXE
    C:\WINDOWS\SYSTEM32\RLVKNLG.EXE
    C:\WINDOWS\SYSTEM32\RLLS.DLL
    C:\WINDOWS\SYSTEM32\RLLS.DLL
    [RelevantKnowledge] C:\WINDOWS\SYSTEM32\RLVKNLG.EXE
    C:\WINDOWS\SYSTEM32\RK.BIN

    Trojan.NewDotNet
    [New.net Startup] C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}
    HKCR\CLSID\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}
    HKCR\CLSID\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}
    HKCR\CLSID\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}\InprocServer32
    HKCR\CLSID\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}\InprocServer32#ThreadingModel
    HKCR\CLSID\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}\ProgID
    HKCR\CLSID\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}\Programmable
    HKCR\CLSID\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}\TypeLib
    HKCR\CLSID\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}\VersionIndependentProgID
    HKCR\Tldctl2.URLLink
    HKCR\Tldctl2.URLLink\CLSID
    HKCR\Tldctl2.URLLink\CurVer
    HKCR\Tldctl2.URLLink.1
    HKCR\Tldctl2.URLLink.1\CLSID
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net#DisplayName
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net#UninstallString
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net#DisplayIcon
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net#DisplayVersion
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net#Publisher
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net#URLInfoAbout
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net#HelpLink
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net#URLUpdateInfo
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net#VersionMajor
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\New.net#VersionMinor
    HKU\.DEFAULT\Software\New.net
    HKU\S-1-5-21-606747145-1677128483-682003330-1003\Software\New.net
    HKU\S-1-5-18\Software\New.net
    HKLM\Software\New.net
    HKLM\Software\New.net#Activity
    HKLM\Software\New.net#InstalledVersion
    HKLM\Software\New.net#InstalledPath
    HKLM\Software\New.net#Tag
    HKLM\Software\New.net#DiscardTag
    HKLM\Software\New.net#FirstTime
    HKLM\Software\New.net#Source
    HKLM\Software\New.net#Prt
    HKLM\Software\New.net#LSPStatus
    HKLM\Software\New.net#NextUpgradeHi
    HKLM\Software\New.net#NextUpgradeLo
    HKLM\Software\New.net#UpgradeCounter
    HKLM\Software\New.net#Search
    HKLM\Software\New.net#Complete
    HKLM\Software\New.net#XpiDone
    C:\Program Files\NewDotNet\readme.html
    C:\Program Files\NewDotNet\uninstall7_48.exe
    C:\Program Files\NewDotNet
    HKLM\Software\Microsoft\Windows\CurrentVersion\Run#New.net Startup [ rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,ClientStartup -s ]
    C:\WINDOWS\NDNUNINSTALL7_22.EXE
    C:\WINDOWS\NDNUNINSTALL7_48.EXE

    Adware.Tracking Cookie
    C:\Documents and Settings\Ireland\Cookies\[email protected][2].txt
    C:\Documents and Settings\Ireland\Cookies\[email protected][2].txt
    C:\Documents and Settings\Ireland\Cookies\[email protected][2].txt
    C:\Documents and Settings\Ireland\Cookies\[email protected]dmt[2].txt
    C:\Documents and Settings\Ireland\Cookies\[email protected][1].txt
    C:\Documents and Settings\Ireland\Cookies\[email protected][1].txt

    Trojan.ErrorSafe
    HKCR\ESSPChck.ESSPChck
    HKCR\ESSPChck.ESSPChck\CLSID
    HKCR\ESSPChck.ESSPChck\CurVer
    HKCR\ESSPChck.ESSPChck.1
    HKCR\ESSPChck.ESSPChck.1\CLSID
    HKCR\clsid\{647b8364-79e0-48e2-a4ca-233abada0c2d}
    HKCR\clsid\{647b8364-79e0-48e2-a4ca-233abada0c2d}\Implemented Categories
    HKCR\clsid\{647b8364-79e0-48e2-a4ca-233abada0c2d}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}
    HKCR\clsid\{647b8364-79e0-48e2-a4ca-233abada0c2d}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}
    HKCR\clsid\{647b8364-79e0-48e2-a4ca-233abada0c2d}\InprocServer32
    HKCR\clsid\{647b8364-79e0-48e2-a4ca-233abada0c2d}\InprocServer32#ThreadingModel
    HKCR\clsid\{647b8364-79e0-48e2-a4ca-233abada0c2d}\ProgID
    HKCR\clsid\{647b8364-79e0-48e2-a4ca-233abada0c2d}\Programmable
    HKCR\clsid\{647b8364-79e0-48e2-a4ca-233abada0c2d}\TypeLib
    HKCR\clsid\{647b8364-79e0-48e2-a4ca-233abada0c2d}\VersionIndependentProgID
    HKCR\typelib\{1b197c22-561f-455f-8511-35b1a45c5c9f}
    HKCR\typelib\{1b197c22-561f-455f-8511-35b1a45c5c9f}\1.0
    HKCR\typelib\{1b197c22-561f-455f-8511-35b1a45c5c9f}\1.0\0
    HKCR\typelib\{1b197c22-561f-455f-8511-35b1a45c5c9f}\1.0\0\win32
    HKCR\typelib\{1b197c22-561f-455f-8511-35b1a45c5c9f}\1.0\FLAGS
    HKCR\typelib\{1b197c22-561f-455f-8511-35b1a45c5c9f}\1.0\HELPDIR
     
  4. BOILED.frogs__

    BOILED.frogs__ Thread Starter

    Joined:
    Jul 14, 2007
    Messages:
    82
    Heres my HJT log



    Logfile of HijackThis v1.99.1
    Scan saved at 4:49:02 PM, on 7/15/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16414)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
    C:\Program Files\Network Associates\VirusScan\Mcshield.exe
    C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
    C:\Program Files\SiteAdvisor\6066\SAService.exe
    C:\Program Files\RealVNC\VNC4\WinVNC4.exe
    C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
    C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
    C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
    C:\Program Files\Picasa2\PicasaMediaDetector.exe
    C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\iLike\1.0.92\ilikesidebar.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Program Files\iTunes\iTunes.exe
    C:\Program Files\Ares\Ares.exe
    C:\WINDOWS\System32\WISPTIS.EXE
    C:\Program Files\Hijackthis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 0;<local>
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
    O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
    O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
    O4 - HKLM\..\Run: [NI.UWAS6_0001_N91M1508] "c:\documents and settings\ireland\application data\winantispyware2006freeinstall[1].exe" -nag
    O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
    O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O8 - Extra context menu item: Add to &Windows Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/MyFunCardsFWBInitialSetup1.0.0.15.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1172654987125
    O17 - HKLM\System\CCS\Services\Tcpip\..\{644A5BCD-E876-488D-9889-BEF3F3EEBB50}: NameServer = 203.2.75.132 198.142.0.51
    O17 - HKLM\System\CS1\Services\Tcpip\..\{644A5BCD-E876-488D-9889-BEF3F3EEBB50}: NameServer = 203.2.75.132 198.142.0.51
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
    O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
    O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
    O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program
    Files\SiteAdvisor\6066\SAService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)



    How does everything look?
     
  5. Cheeseball81

    Cheeseball81 Retired Moderator

    Joined:
    Mar 3, 2004
    Messages:
    84,315
    Rescan with Hijack This.
    Close all browser windows except Hijack This.
    Put a check mark beside these entries and click "Fix Checked".

    O4 - HKLM\..\Run: [NI.UWAS6_0001_N91M1508] "c:\documents and settings\ireland\application data\winantispyware2006freeinstall[1].exe" -nag

    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...up1.0.0.15.cab


    Reboot, post a new log.
     
  6. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/595612

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice