Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

HiJackThis log. [RESOLVED]


  • This topic is locked This topic is locked

#16
BadlndsBob

BadlndsBob

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
I did a root-kit check with Winpfind35u too!


catchme 0.3.1319 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-08 12:46:18
Windows 5.2.3790 Service Pack 2 WOW64 NTFS

detected NTDLL code modification:
ZwEnumerateKey 0 != 47, ZwQueryKey 0 != 19, ZwOpenKey 0 != 15, ZwClose 0 != 12, ZwEnumerateValueKey 0 != 16, ZwQueryValueKey 0 != 20, ZwOpenFile 0 != 48, ZwQueryDirectoryFile 0 != 50, ZwQuerySystemInformation 0 != 51Initialization error
  • 0

Advertisements


#17
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts

Thanks again. I didn't know this kind of thing ever got this drawn out.

It does take longer on a 64bit system as there are more files to investigate plus the duplications of 32 and 64

Start WinPFind35. Copy/Paste the information in the quotebox below into the pane where it says "Paste fix here" and then click the Run Fix button.

[Files/Folders - Created Within 90 days]
NY -> 9275D.mht -> %SystemRoot%\System32\9275D.mht
[Files/Folders - Modified Within 90 days]
NY -> kleyxg.ini -> C:\Documents and Settings\Administrator\Local Settings\Temp\kleyxg.ini
[Empty Temp Folders]

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new Hijackthis log.

I will review the information when it comes back in.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

PRIOR TO POSTING

Lets give your system a spring clean as all I have found so far are a few remnants of old infections


Click start then all programmes, accessories, system tools to run disc clean up

Reboot

Download, install and run Tuneup Utilities 2008

Select Free up disk space


Select Unneccesary files and backups then clean

Select Maintain Windows

Run Drive Defrag

Run Tune Up registry clean up

Then run Reg Defrag, the screen will lose colour during the process which can take a few minutes and then needs a reboot

Those will have cleared the drive of obsolete software errors

These are suggestions for making the most of the free trial

Select Increase performance

Run the internet Optimiser to accelerate downloads, select the speed just above your actual connection speed, this requires a reboot.

After the reboot, click Increase performance then system optimizer to run system advisor
  • 0

#18
BadlndsBob

BadlndsBob

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
Okay, I did the things you suggested. The TuneUp Utilities seems like a good program.

Attached File  WinPFind35.Txt   198.22KB   56 downloads
  • 0

#19
BadlndsBob

BadlndsBob

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
On my PC, what infections have you seen or seen traces of? With all the programs I have been running, is it surprising that I couldn't get rid of them?
  • 0

#20
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Just two old traces of a generic win32 trojan, they did not appear to be active. But now we can rule out the problem as being malware related with a reasonable degree of certainty. I will now tidy your system up from my downloads - If you can let me know the current state of your system I will see where we go from here

But first....

Now the best part of the day ----- Your log now appears clean :)

Double click winpfind35 once again and you should see a CleanUp! button, press that button, you may get prompted by your firewall that winpfind35 wants to contact the internet, allow this, a cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will delete all the tools you have downloaded plus itself



Now to get you off to a good start we will re-set your restore points so that all the bad stuff is gone for good. Then if you need to restore at some stage you will be clean. There are several ways to reset your your restore point but this is my method:

1. Select Start > All Programs > Accessories > System tools > System Restore.
2. On the dialogue box that appears select Create a Restore Point
3. Click NEXT
4. Enter a name e.g. Clean
5. Click CREATE

You now have a clean restore point, to get rid of the bad ones:

1. Select Start > All Programs > Accessories > System tools > Disk Cleanup.
2. In the Drop down box that appears select your main drive e.g. C
3. Click OK
4. The System will do some calculation and the display a dialogue box with TABS
5. Select the More Options Tab.
6. At the bottom will be a system restore box with a CLEANUP button click this
7. Accept the Warning and select OK again, the program will close and you are done



Now that you are clean, to help protect your computer in the future I recommend that you get the following free program: It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

To learn more about how to protect yourself while on the internet read this article by Tony Klien: So how did I get infected in the first place?


Keep safe :)

If you could now update me in your current problems
  • 0

#21
BadlndsBob

BadlndsBob

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
:)

My big problem is that my browser is so slow! This is an issue when I use FireFox (main browser) or IE. I use FasterFox (I began using it after my browser became so slow) which reports the time it takes to load pages. To go from the last screen to be able to post (load this one page) has taken a recorded 96.960 seconds. Most new web pages (and often even going back to the last page) takes 1-1/2 or more minutes to load. Trying to load the CNET mainpage, with all of its ads, takes maybe 5 minutes. For me to open FireFox, go to GeeksToGo, and find my post takes about 15 minutes! Also, when FireFox hangs, the rest of the PC can hang for a minute too. (Remember, I am using an AMD dual core and Verizon FIOS.) I can't take it!

Can you help me? This is causing me to master FreeCell while I wait for pages to load. I only have 1024 of RAM and do plan to order more. Still, I don't think the RAM can make my PC go so slow.
  • 0

#22
BadlndsBob

BadlndsBob

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
As a result of a search I did, I uninstalled some of FireFox's add-ons. Now my PC is flying again. The CNET page takes no more than 1-1/2 seconds to load! Thanks!!!!! :)

RESOLVED!!!
  • 0

#23
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Darn you stole my glory :)

Nice to hear I will close now
  • 0

#24
Essexboy

Essexboy

    GeekU Moderator

  • Retired Staff
  • 69,964 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP