Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

pc infected


  • Please log in to reply

#1
toufik

toufik

    New Member

  • Member
  • Pip
  • 6 posts
hi, my pc is infected with many malware i have the following problesm :
- an istsvc file thaht always here whene i deleted.
- many popus like ( sherch result for...., find a...at....)
- always hang up demand.
- my connection is slow and i believe that is related to an infection.
- the item 04 of my hijacjthis log always here when i fixed it, and i don't have mcaffe, navprotect, rant ...etc in my pc !!!)
- when i run a software a message related to an autoexec.NT. is apear and i can not run.

please help me.

this is my hijackthis log :

Logfile of HijackThis v1.99.0
Scan saved at 13:27:28, on 25/02/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\netdde.exe
D:\WINDOWS\system32\cisvc.exe
D:\WINDOWS\System32\imapi.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\vssvc.exe
D:\WINDOWS\System32\wbem\wmiapsrv.exe
D:\WINDOWS\System32\dmadmin.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\System32\rant.exe
D:\WINDOWS\qniqtso.exe
D:\Program Files\ISTsvc\istsvc.exe
D:\WINDOWS\nvsvca32.exe
D:\WINDOWS\msexploren.exe
D:\WINDOWS\System32\navprotect.exe
D:\WINDOWS\System32\lah.exe
D:\WINDOWS\System32\mcafee32.exe
D:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\WINDOWS\system32\cidaemon.exe
D:\WINDOWS\System32\navprot32.exe
D:\Documents and Settings\Benteboula Toufik\Bureau\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:1030
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;cgi*.ebay.com;disney.go.com;msa_e1.ebay.com;rhapsody_app*.listen.com;<local>
O4 - HKLM\..\Run: [Norton AutoProtect] navprot32.exe
O4 - HKLM\..\Run: [NAV Auto Protect] navprotect.exe
O4 - HKLM\..\Run: [Norton Personal Firewall] lah.exe
O4 - HKLM\..\Run: [rant] rant.exe
O4 - HKLM\..\Run: [antiware] D:\windows\system32\elitedez32.exe
O4 - HKLM\..\Run: [×jœS˜‰ØUÑñT»óonÄ;D:\Program Files\ISTsvc\istsvc.exe] D:\WINDOWS\qniqtso.exe
O4 - HKLM\..\Run: [McAfee Windows Protection] mcafee32.exe
O4 - HKLM\..\Run: [IST Service] D:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [nvsvca32] D:\WINDOWS\nvsvca32.exe
O4 - HKLM\..\Run: [SvcH0st] D:\WINDOWS\msexploren.exe /i
O4 - HKLM\..\RunServices: [Norton Personal Firewall] lah.exe
O4 - HKLM\..\RunServices: [Norton AutoProtect] navprot32.exe
O4 - HKLM\..\RunServices: [rant] rant.exe
O4 - HKLM\..\RunServices: [NAV Auto Protect] navprotect.exe
O4 - HKLM\..\RunServices: [McAfee Windows Protection] mcafee32.exe
O4 - HKCU\..\Run: [NAV Auto Protect] navprotect.exe
O4 - HKCU\..\Run: [Norton Personal Firewall] lah.exe
O4 - HKCU\..\Run: [Norton AutoProtect] navprot32.exe
O4 - HKCU\..\Run: [rant] rant.exe
O4 - HKCU\..\Run: [McAfee Windows Protection] mcafee32.exe
O8 - Extra context menu item: Download All by FlashGet - D:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - D:\Program Files\FlashGet\jc_link.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{A760F5A3-BB80-4D42-862C-AB65B3D2B149}: NameServer = 81.22.91.164 81.22.90.29
O23 - Service: Service d'administration du Gestionnaire de disque logique - Unknown - D:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements - Unknown - D:\WINDOWS\system32\services.exe
O23 - Service: Service COM de gravage de CD IMAPI - Unknown - D:\WINDOWS\System32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting - Unknown - D:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: DDE réseau - Unknown - D:\WINDOWS\system32\netdde.exe
O23 - Service: DSDM DDE réseau - Unknown - D:\WINDOWS\system32\netdde.exe
O23 - Service: Plug-and-Play - Unknown - D:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance - Unknown - D:\WINDOWS\system32\sessmgr.exe
O23 - Service: Prise en charge des cartes à puces - Unknown - D:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Carte à puce - Unknown - D:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance - Unknown - D:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume - Unknown - D:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI - Unknown - D:\WINDOWS\System32\wbem\wmiapsrv.exe
O23 - Service: Network Security Service (NSS) - Unknown - D:\WINDOWS\javaqr.exe (file missing)
  • 0

Advertisements


#2
-=jonnyrotten=-

-=jonnyrotten=-

    Member 2k

  • Retired Staff
  • 2,678 posts
You may wish to print out a copy of these instructions to follow while you complete this procedure.
Please save Hijack This in a permanent folder (i.e. C:\HJT). This ensures backups are saved and accessible.
Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu). Be sure you're able to view hidden
files
.

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:1030
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;cgi*.ebay.com;disney.go.com;msa_e1.ebay.com;rhapsody_app*.listen.com;<local>
O4 - HKLM\..\Run: [Norton AutoProtect] navprot32.exe
O4 - HKLM\..\Run: [NAV Auto Protect] navprotect.exe
O4 - HKLM\..\Run: [Norton Personal Firewall] lah.exe
O4 - HKLM\..\Run: [rant] rant.exe
O4 - HKLM\..\Run: [antiware] D:\windows\system32\elitedez32.exe
O4 - HKLM\..\Run: [×jœS˜‰ØUÑñT»óonÄ;D:\Program Files\ISTsvc\istsvc.exe] D:\WINDOWS\qniqtso.exe
O4 - HKLM\..\Run: [McAfee Windows Protection] mcafee32.exe
O4 - HKLM\..\Run: [IST Service] D:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [nvsvca32] D:\WINDOWS\nvsvca32.exe
O4 - HKLM\..\Run: [SvcH0st] D:\WINDOWS\msexploren.exe /i
O4 - HKLM\..\RunServices: [Norton Personal Firewall] lah.exe
O4 - HKLM\..\RunServices: [Norton AutoProtect] navprot32.exe
O4 - HKLM\..\RunServices: [rant] rant.exe
O4 - HKLM\..\RunServices: [NAV Auto Protect] navprotect.exe
O4 - HKLM\..\RunServices: [McAfee Windows Protection] mcafee32.exe
O4 - HKCU\..\Run: [NAV Auto Protect] navprotect.exe
O4 - HKCU\..\Run: [Norton Personal Firewall] lah.exe
O4 - HKCU\..\Run: [Norton AutoProtect] navprot32.exe
O4 - HKCU\..\Run: [rant] rant.exe
O4 - HKCU\..\Run: [McAfee Windows Protection] mcafee32.exe
O8 - Extra context menu item: Download All by FlashGet - D:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - D:\Program Files\FlashGet\jc_link.htm
O23 - Service: Network Security Service (NSS) - Unknown - D:\WINDOWS\javaqr.exe (file missing)

Remove the following files in bold (if found):

D:\WINDOWS\System32\rant.exe
D:\WINDOWS\qniqtso.exe
D:\Program Files\ISTsvc
D:\WINDOWS\nvsvca32.exe
D:\WINDOWS\msexploren.exe
D:\WINDOWS\System32\navprotect.exe
D:\WINDOWS\System32\lah.exe
D:\WINDOWS\System32\mcafee32.exe
D:\WINDOWS\System32\navprot32.exe
D:\windows\system32\elitedez32.exe
D:\WINDOWS\msexploren.exe
D:\Program Files\FlashGet
D:\WINDOWS\javaqr.exe

Copy and paste the quoted text below into a new notepad document. Now "Save As" export.bat, and change the "Save as Type" to "All Files" and save the file to your desktop. Now double click the file, it will open a notepad file with some text in it. Copy and paste the content of the file back here:

cd\
regedit /e HKCURun.txt "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run"
regedit /e HKLMRun.txt "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run"


copy HKLMRun.txt + HKCURun.txt = Output.txt
notepad Output.txt


Reboot and post a new Log.

-=jonnyrotten=- :tazz:
  • 0

#3
toufik

toufik

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
ook, thank you for the reply !!!
i done all what you say but i didn't find :
d:\windows\qniqsto.exe
d:\windows\javaqr.exe

my system seems to be clear !!! this is my new hijackthis log :

Logfile of HijackThis v1.99.0
Scan saved at 19:26:03, on 26/02/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\WINDOWS\system32\netdde.exe
D:\WINDOWS\system32\cisvc.exe
D:\WINDOWS\System32\imapi.exe
D:\WINDOWS\system32\sessmgr.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\vssvc.exe
D:\WINDOWS\System32\wbem\wmiapsrv.exe
D:\WINDOWS\System32\dmadmin.exe
D:\WINDOWS\Explorer.EXE
D:\HTJ\hijackthis\HijackThis.exe

O23 - Service: Service d'administration du Gestionnaire de disque logique - Unknown - D:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements - Unknown - D:\WINDOWS\system32\services.exe
O23 - Service: Service COM de gravage de CD IMAPI - Unknown - D:\WINDOWS\System32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting - Unknown - D:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: DDE réseau - Unknown - D:\WINDOWS\system32\netdde.exe
O23 - Service: DSDM DDE réseau - Unknown - D:\WINDOWS\system32\netdde.exe
O23 - Service: Plug-and-Play - Unknown - D:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance - Unknown - D:\WINDOWS\system32\sessmgr.exe
O23 - Service: Prise en charge des cartes à puces - Unknown - D:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Carte à puce - Unknown - D:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance - Unknown - D:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume - Unknown - D:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI - Unknown - D:\WINDOWS\System32\wbem\wmiapsrv.exe


thanks to tell me if is it good !!!
best regards !!!
  • 0

#4
-=jonnyrotten=-

-=jonnyrotten=-

    Member 2k

  • Retired Staff
  • 2,678 posts
Congratulations! Your system is CLEAN :tazz:

How do you prevent spyware from being installed again? We strongly recommend installing SpywareBlaster (it's free for personal use) Click Here.

Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted pests.
Block spyware/tracking cookies in Internet Explorer and Mozilla/Firefox.
Restrict the actions of potentially dangerous sites in Internet Explorer.
Consumes no system resources.

Download, run, check for updates, download updates, select all, protect against checked. All done. Check for updates every couple of weeks. If you have any errors running the program like a missing file see the link at the bottom of the javacool page.

It's also very important to keep your system up to date to avoid unnecessary security risks. Click Here to make sure that you have the latest patches for Windows.

These next two steps are optional, but will provide the greatest protection.
1. Use ANY browser besides Internet Explorer, almost every exploit is crafted to take advantage of an IE weakness. We usually recommend FireFox Posted Image.
2. Install Sun's Java. It's much more secure than Microsoft's Java Virtual Machine .

It's okay to delete the Hijack This folder if everything is working okay.

After doing all these, your system will be thoroughly protected from future threats. ;)

-=jonnyrotten=- :thumbsup:
  • 0

#5
toufik

toufik

    New Member

  • Topic Starter
  • Member
  • Pip
  • 6 posts
hi,

i download all the application you told me , but i steel have a little problem, please tell me where or how i can fixed it.

when i run an apllication a message with title " under 16 bit windows" appear and show this " d:\windows\system32\autoexec.nt. is not appropriate to ms dos 16 bit application and microsoft windows" and i can't run application i must close.

what this problem ?
is it a spyware infection wich infect autoexec.NT ?

help me ?

waiting , best regards !!
  • 0

#6
bdlt

bdlt

    Member

  • Member
  • PipPipPip
  • 875 posts
Here's something you might try for the autoexec.nt problem:

1. Insert the CD into the CD drive or DVD drive.
2. Click Start, and then click Run.
3. In the Open box, type cmd, and then click OK.
4. At the command prompt, type the following commands, pressing ENTER
after each command:

expand CD-ROM Drive Letter:\i386\config.nt_ c:\windows\system32\config.nt
expand CD-ROM Drive Letter:\i386\autoexec.nt_ c:\windows\system32\autoexec.nt
expand CD-ROM Drive Letter:\i386\command.co_ c:\windows\system32\command.com
exit
5. Start or install the program. If the issue is resolved, do not
complete the remaining steps. If the issue is not resolved, go to the next step.

steps 6 and on can be found at
http://support.micro...kb;en-us;324767

Some users had the autoexec.nt file damaged/removed after restarting the pc. The steps above will replace the files, but will not prevent damage or removal.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP