Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

graphicpipeline (again)


  • Please log in to reply

#1
Gavi

Gavi

    New Member

  • Member
  • Pip
  • 1 posts
I have tried to follow the directions posted in the forums but I'm still having trouble. I have downloaded HJT, but the virus closes it as soon as it opens. I have downloaded ComboFix and have the log. Could someone please tell me how to deal with graphicpipeline? I don't understand much about this.
thanks.
Here's the log from ComboFix:

"user" - 07-04-14 19:43:12 Service Pack 2
ComboFix 07-04-05.Rev3 - Running from: "C:\Program Files"
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\ardstsoiwc\winlogon.exe
C:\WINDOWS\system32\ardstsoiwc\winlogon.ini
C:\WINDOWS\system32\netstat.com
C:\WINDOWS\system32\taskkill.com
C:\install.log
((((((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
-------\nm
((((((((((((((((((((((((((((((( Files Created from 2007-03-14 to 2007-04-14 ))))))))))))))))))))))))))))))))))
2007-04-14 19:42 1,171,910 --a------ C:\Program Files\ComboFix.exe
2007-04-14 19:34 488,144 --a------ C:\Program Files\HJTSetup.exe
2007-04-12 15:53 <DIR> d-------- C:\WINDOWS\LastGood
2007-04-12 15:52 <DIR> d-------- C:\Program Files\MSN Messenger
2007-04-12 15:48 18,040,176 --a------ C:\Program Files\Install_Messenger_nous.exe
2007-04-12 15:48 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2007-04-11 18:31 14,764,808 --a------ C:\Program Files\DivXInstaller.exe
2007-04-11 18:20 <DIR> d--hs---- C:\WINDOWS\system32\ardstsoiwc
2007-04-11 18:20 <DIR> d-------- C:\Program Files\LimeWire
2007-04-11 18:16 359,112 --a------ C:\Program Files\LimeWireWin.exe
2007-04-09 21:03 <DIR> d-------- C:\Program Files\Common Files\xing shared
2007-04-09 21:02 <DIR> d-------- C:\Program Files\Real
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-04-11 18:37 10240 --ahs---- C:\Program Files\thumbs.db
2007-04-11 18:25 360576 --a------ C:\WINDOWS\system32\drivers\tcpip.sys
2007-04-09 21:07 7497 --a------ C:\WINDOWS\mozver.dat
2007-03-22 20:34 185628 --a------ C:\Program Files\imgp1700.jpg
2007-03-17 09:45 292864 --a------ C:\WINDOWS\system32\winsrv.dll
2007-03-08 11:48 578048 --a------ C:\WINDOWS\system32\user32.dll
2007-03-08 11:48 40960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-03-08 11:48 282112 --a------ C:\WINDOWS\system32\gdi32.dll
2007-03-08 09:49 1843968 --a------ C:\WINDOWS\system32\win32k.sys
2007-02-05 16:17 185344 --a------ C:\WINDOWS\system32\upnphost.dll
2007-01-19 12:53 51056 --a------ C:\WINDOWS\system32\sirenacm.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"NBJ"="\"C:\\Program Files\\Ahead\\Nero BackItUp\\NBJ.exe\""
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"SoundMan"="SOUNDMAN.EXE"
"nwiz"="nwiz.exe /install"
"Picasa Media Detector"="C:\\Program Files\\Picasa2\\PicasaMediaDetector.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"="Narrator.exe"
"tscuninstall"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,6d,\
33,32,5c,74,73,63,75,70,67,72,64,2e,65,78,65,00
"nlpo_01"=hex(2):63,6d,64,2e,65,78,65,20,2f,63,20,6d,64,20,22,25,55,53,45,52,\
50,52,4f,46,49,4c,45,25,5c,4c,6f,63,61,6c,20,53,65,74,74,69,6e,67,73,5c,54,\
65,6d,70,22,00
"nlpo_02"=hex(2):72,75,6e,64,6c,6c,33,32,20,61,64,76,70,61,63,6b,2e,64,6c,6c,\
2c,4c,61,75,6e,63,68,49,4e,46,53,65,63,74,69,6f,6e,20,6e,6c,69,74,65,2e,69,\
6e,66,2c,6e,4c,69,74,65,52,65,67,00
"nlpo_03"=hex(2):72,75,6e,64,6c,6c,33,32,20,61,64,76,70,61,63,6b,2e,64,6c,6c,\
2c,4c,61,75,6e,63,68,49,4e,46,53,65,63,74,69,6f,6e,20,6e,6c,69,74,65,2e,69,\
6e,66,2c,53,00

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Microsoft Works Calendar Reminders.lnk"
"backup"="C:\\WINDOWS\\pss\\Microsoft Works Calendar Reminders.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\COMMON~1\\MICROS~1\\WORKSS~1\\wkcalrem.exe "
"item"="Microsoft Works Calendar Reminders"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NVMCTRAY"
"hkey"="HKCU"
"command"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NVMCTRAY.DLL,NvTaskbarInit"
"inimapping"="0"


[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NVMCTRAY.DLL,NvTaskbarInit"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0

*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_USNJSVC


Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - user.job


********************************************************************

catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 07-04-14 19:48:24
C:\ComboFix-quarantined-files.txt ... 07-04-14 19:48
  • 0

Advertisements


#2
Titan8990

Titan8990

    Member

  • Member
  • PipPipPipPipPip
  • 2,189 posts
This is the wrong forum. This is what you are looking for: http://www.geekstogo...o_Here-f37.html.

They like to start with a HiJackThis log first though.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP