Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

NetMon and possible something else.

Started by Lifein8one3 , Oct 24 2006 11:05 PM

  • This topic is locked This topic is locked

#1
Lifein8one3
Posted 24 October 2006 - 11:05 PM

Lifein8one3

    Member

  • Member
  • PipPipPip
  • 129 posts
Hijack This Log:

Logfile of HijackThis v1.99.1
Scan saved at 11:52:53 PM, on 10/24/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\Common Files\AOL\1158623984\ee\AOLSoftware.exe
C:\Program Files\Creative\SBAudigy\TaskBar\CTLTray.exe
C:\Program Files\Creative\SBAudigy\TaskBar\CTLTask.exe
C:\Program Files\AIM95\aim.exe
C:\Program Files\Linksys\WMP11 Config Utility\WMP11CFG.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Xfire\Xfire.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\mIRC\mirc.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Yeoj\Desktop\Previous Desktops\Desktop 1\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1158623984\ee\AOLSoftware.exe
O4 - HKCU\..\Run: [TaskTray] "C:\Program Files\Creative\SBAudigy\TaskBar\CTLTray.exe"
O4 - HKCU\..\Run: [TaskBar] "C:\Program Files\Creative\SBAudigy\TaskBar\CTLTask.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Wireless PCI Card Configuration Utility.lnk = C:\Program Files\Linksys\WMP11 Config Utility\WMP11CFG.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?LinkID=39204
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.c.../acclaim_v4.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe

Ewido Log:

---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------

+ Created at: 12:04:56 AM 10/25/2006

+ Scan result:



C:\Program Files\PrintView\printhook030.dll -> Adware.PrintView : Cleaned with backup (quarantined).
C:\Program Files\PrintView\pvmodule.exe -> Adware.PrintView : Cleaned with backup (quarantined).
C:\WINDOWS\system32\xfhbgxl.dll -> Adware.PurityScan : Cleaned with backup (quarantined).
C:\Program Files\Network Monitor\netmon.exe -> Not-A-Virus.Monitor.Win32.NetMon.a : Error during cleaning.
C:\Documents and Settings\Yeoj\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Yeoj\Cookies\yeoj@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Yeoj\Cookies\yeoj@adrevolver[3].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\Yeoj\Cookies\yeoj@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Yeoj\Cookies\yeoj@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Yeoj\Cookies\yeoj@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned.
C:\Documents and Settings\Yeoj\Cookies\yeoj@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Yeoj\Cookies\yeoj@com[1].txt -> TrackingCookie.Com : Cleaned.
C:\Documents and Settings\Yeoj\Cookies\yeoj@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Yeoj\Cookies\yeoj@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\Yeoj\Cookies\[email protected][2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Yeoj\Cookies\yeoj@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Yeoj\Cookies\yeoj@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\Yeoj\Cookies\yeoj@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\Yeoj\Cookies\[email protected][1].txt -> TrackingCookie.Reliablestats : Cleaned.
C:\Documents and Settings\Yeoj\Cookies\yeoj@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\Yeoj\Cookies\yeoj@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Cleaned.
C:\Documents and Settings\Yeoj\Cookies\yeoj@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Documents and Settings\Yeoj\Cookies\yeoj@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\Yeoj\Cookies\[email protected][1].txt -> TrackingCookie.Yieldmanager : Cleaned.
C:\Documents and Settings\Yeoj\Cookies\yeoj@zedo[1].txt -> TrackingCookie.Zedo : Cleaned.


::Report end

Ewido cant get rid of NetMon
  • 0

Advertisements

#2
Octagonal
Posted 27 October 2006 - 06:17 PM

Octagonal

    Member 2k

  • Member
  • PipPipPipPipPip
  • 2,528 posts
Hi Lifein8one3,

Sorry for the delay the helpers have been busy.

HijackThis creates backups, these are needed in case of any recovery issues.
Please create a directory on your C:\ drive called C:\HJT and move HijackThis.exe to that folder.

Some malware is interfering with the HijackThis scan. Could you navigate to C:\HJT\HijackThis.exe and rename HijackThis.exe to Analyse.exe, in future this is the program name that I will be referring to when I instruct you to run HijackThis.

Create an Uninstall list
  • Open HijackThis, click Config, click Misc Tools
  • Click "Open Uninstall Manager"
  • Click "Save List" (generates uninstall_list.txt)
  • Click Save, copy and paste the results in your next post.
Thanks.
  • 0

#3
Lifein8one3
Posted 28 October 2006 - 08:18 PM

Lifein8one3

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 129 posts
ok doing that now, and no prob i know you guys are busy
  • 0

#4
Lifein8one3
Posted 29 October 2006 - 01:02 AM

Lifein8one3

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 129 posts
Here is the list:

Adobe Acrobat 5.0
Adobe Flash Player 9 ActiveX
Agatha Christie - And Then There Were None
AOL Instant Messenger (SM)
AOL Uninstaller (Choose which Products to Remove)
ATI Catalyst Control Center
ATI Display Driver
Audacity 1.2.4
Bots
Call of Duty® 2
CleanUp!
CMN3
ewido anti-spyware 4.0
HijackThis 1.99.1
J2SE Runtime Environment 5.0 Update 3
Kaput Version 4
MAIET entertainment - Gunz
Microsoft .NET Framework 2.0
Microsoft User-Mode Driver Framework Feature Pack 1.0 (Beta2)
mIRC
MultiRes (remove only)
Network Monitor
Panda ActiveScan
Panda spyXposer
PlanetSide
PlanetSide
Security Update for Microsoft .NET Framework 2.0 (KB917283)
Security Update for Microsoft .NET Framework 2.0 (KB922770)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 8 (KB917734)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB925486)
Seismovision 3 (remove only)
Silkroad
Sound Blaster Audigy
TuneUp Utilities 2006
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Ventrilo Client
VideoLAN VLC media player 0.8.5
Viewpoint Media Player
WinAce Archiver
Windows Defender
Windows Installer 3.1 (KB893803)
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
Wireless PCI Card Configuration Utility
World of Warcraft
Xfire (remove only)

Also my comp resources are at 100% and everything is slow. Just started happening.
  • 0

#5
Octagonal
Posted 29 October 2006 - 01:13 AM

Octagonal

    Member 2k

  • Member
  • PipPipPipPipPip
  • 2,528 posts
Hi Lifein8one3,

Could you please post a fresh HijackThis log using the renamed file.

Thanks.
  • 0

#6
Lifein8one3
Posted 29 October 2006 - 01:20 AM

Lifein8one3

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 129 posts
yes doing that as we speak
  • 0

#7
Lifein8one3
Posted 29 October 2006 - 01:21 AM

Lifein8one3

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 129 posts
Logfile of HijackThis v1.99.1
Scan saved at 3:21:30 AM, on 10/29/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\Analyse.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - C:\WINDOWS\system32\uvgaauwh.dll
O2 - BHO: (no name) - {45E7781B-9BF1-C072-80FA-B069428C869A} - C:\WINDOWS\system32\rcbi.dll
O2 - BHO: (no name) - {552CD94B-EFA0-10B3-824B-03E5D49D7FE0} - C:\WINDOWS\system32\sttthgn.dll
O2 - BHO: (no name) - {5AA0C0B3-7F6D-FBF3-D2AB-057200BF18DF} - C:\WINDOWS\system32\yynkqhc.dll
O2 - BHO: (no name) - {D4E0C464-30CE-4075-9A10-71FD106C2847} - (no file)
O2 - BHO: (no name) - {DD01A622-2D4C-402C-9059-A9314D311D0A} - C:\WINDOWS\system32\ssqrs.dll
O2 - BHO: (no name) - {E641FCB3-4508-4FDE-2410-6E74E3A6789A} - (no file)
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [CTStartup] C:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /run
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [TaskTray] "C:\Program Files\Creative\SBAudigy\TaskBar\CTLTray.exe"
O4 - HKCU\..\Run: [TaskBar] "C:\Program Files\Creative\SBAudigy\TaskBar\CTLTask.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\Xfire.exe
O4 - Global Startup: Wireless PCI Card Configuration Utility.lnk = C:\Program Files\Linksys\WMP11 Config Utility\WMP11CFG.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?LinkID=39204
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.c.../acclaim_v4.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O20 - Winlogon Notify: ssqrs - C:\WINDOWS\system32\ssqrs.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winetn32 - winetn32.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
  • 0

#8
Octagonal
Posted 29 October 2006 - 01:51 AM

Octagonal

    Member 2k

  • Member
  • PipPipPipPipPip
  • 2,528 posts
Hi Lifein8one3,

Ah yes, there they are....

Go here to upload a suspicious file for analysis.
  • Enter your username from this forum
  • Copy and paste the link to this thread
  • Browse for these filenames in the seperate boxes:

    C:\WINDOWS\system32\uvgaauwh.dll
    C:\WINDOWS\system32\rcbi.dll
    C:\WINDOWS\system32\sttthgn.dll
    C:\WINDOWS\system32\yynkqhc.dll
    C:\WINDOWS\system32\ssqrs.dll
  • In the comments, please mention that I asked you to upload this file
  • Click on Send File
Please download VundoFix.exe to your desktop
  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will reboot your computer, click OK.
  • Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread.
Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.

Thanks.
  • 0

#9
Lifein8one3
Posted 29 October 2006 - 02:47 AM

Lifein8one3

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 129 posts
ok done. scanning vundo now
  • 0

#10
Lifein8one3
Posted 29 October 2006 - 02:52 AM

Lifein8one3

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 129 posts
Well...it removed a few files. Restarted. Booted up much faster. Still gettin virus popups. Maybe we arent finished i dont know lol. Still an infection somewhere. I did a panda scan earlier but didnt save report. There was about 37 infections. Just lettin u know.


*i went to my add/remove prgrms list and Net Monitor was still there.

Edited by Lifein8one3, 29 October 2006 - 02:59 AM.

  • 0

Advertisements

#11
Octagonal
Posted 29 October 2006 - 09:04 PM

Octagonal

    Member 2k

  • Member
  • PipPipPipPipPip
  • 2,528 posts
Hi Lifein8one3,

Yes, we certainly have more work to do here.

Please go to Start then Control Panel then Add/Remove Programs and remove the following:

Network Monitor
Viewpoint Media Player

Please note any other programs that you dont recognize in that list in your next response

Do you have an Anti-Virus program installed? I don't see any indication of one in your HJT log, if not could you please download and install one of these (these are also free for personal use):I need to see the contents of C:\vundofix.txt. Could you please post those results.

Thanks.
  • 0

#12
Lifein8one3
Posted 30 October 2006 - 04:54 PM

Lifein8one3

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 129 posts
It let me remove View Point. When i try to remove NetMonitor it says Critical Error and wont remove.


C:\WINDOWS\system32\srqss.bak2

Beginning removal...

Attempting to delete C:\WINDOWS\system32\sttthgn.dll
C:\WINDOWS\system32\sttthgn.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ssqrs.dll
C:\WINDOWS\system32\ssqrs.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\srqss.ini
C:\WINDOWS\system32\srqss.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\srqss.bak1
C:\WINDOWS\system32\srqss.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\srqss.bak2
C:\WINDOWS\system32\srqss.bak2 Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.2.6

Checking Java version...

Java version is 1.5.0.3

Java version is 1.5.0.8

Scan started at 4:50:18 AM 10/29/2006

Listing files found while scanning....

No infected files were found.
  • 0

#13
Octagonal
Posted 31 October 2006 - 07:27 AM

Octagonal

    Member 2k

  • Member
  • PipPipPipPipPip
  • 2,528 posts
Hi Lifein8one3,

Do you have an Anti-Virus program installed? I don't see any indication of one in your HJT log, if not could you please download and install one of these (these are also free for personal use):


You didn't let me know if you have an Anti-virus program installed or not. Please let me know.

There seems to be a lot missing from your HijackThis log. Lets see if a Rootkit is involved.

Download and Save Blacklight to your desktop (choose "I ACCEPT" then click "DOWNLOAD" on the website).

Double-click blbeta.exe then accept the agreement, click > "Scan" then > "Next".

You'll see a list of all items found. There will also be a log on your desktop with the name "fsbl.xxxxxxxxxxxxxx.log" (the xxxxxxxxxxxxxx stand for numbers).

Copy and paste this log in your next reply. Don't choose the rename option yet! I want to see the log first, because legitimate items can also be present there, such as "wbemtest.exe"

Thanks.
  • 0

#14
Lifein8one3
Posted 31 October 2006 - 02:58 PM

Lifein8one3

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 129 posts
Oh sorry, i just downloaded AVG. Will get u that log ASAP
  • 0

#15
Lifein8one3
Posted 01 November 2006 - 03:52 PM

Lifein8one3

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 129 posts
11/01/06 16:07:03 [Info]: BlackLight Engine 1.0.47 initialized
11/01/06 16:07:03 [Info]: OS: 5.1 build 2600 (Service Pack 2)
11/01/06 16:07:04 [Note]: 7019 4
11/01/06 16:07:04 [Note]: 7005 0
11/01/06 16:07:06 [Note]: 7006 0
11/01/06 16:07:06 [Note]: 7011 292
11/01/06 16:07:06 [Note]: 7026 0
11/01/06 16:07:06 [Note]: 7026 0
11/01/06 16:07:11 [Note]: FSRAW library version 1.7.1020
11/01/06 16:13:50 [Note]: 7007 0
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP