Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

hijakthis [CLOSED]

Started by Sedi , Jun 30 2005 01:50 AM

  • This topic is locked This topic is locked

#1
Sedi
Posted 30 June 2005 - 01:50 AM

Sedi

    New Member

  • Member
  • Pip
  • 5 posts
I keep getting Aurra pop-ups....
I cant seem to get the nail.exe file to stay away....
and I cant get rid of the drpmon.dll file.....
I have ran all the required stuff and some extras....
Here are my logs....


Logfile of HijackThis v1.99.1
Scan saved at 1:03:27 AM, on 6/30/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
c:\windows\system32\gowzet.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [epcchv] c:\windows\system32\gowzet.exe r
O4 - HKLM\..\RunOnce: [AAW] "C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe" "+b1"
O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin\npjpi142_05.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.c...utocomplete.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3B869A6F-B0FE-440E-96C9-D20A237B706A}: NameServer = 4.2.2.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{99C2A277-40E5-4C84-9214-A21786E4CA32}: NameServer = 4.2.2.2
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)




---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 1:03:08 AM, 6/30/2005
+ Report-Checksum: 3958B92D

+ Scan result:

[2156] VM_00900000 -> Spyware.BetterInternet


::Report End

Edited by Sedi, 30 June 2005 - 03:28 AM.

  • 0

Advertisements

#2
Sedi
Posted 30 June 2005 - 03:31 AM

Sedi

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
and just so you can read it, here is the info in the file for that spyware.betterinternet that popped up in my EWido log....



url
http://www.geekstogo...forum/index.php?
abetterinternet.com/
0
223484416
29793404
228783376
29719894
*
ctr
16
abetterinternet.com/
0
223484416
29793404
228943376
29719894
*
dly
1-1120123529-11514:2026805:11021:2541092:11354:1164025:8283:2407514:9628:72792:8472:135027:11245:2230664:10757:577:11185:1178563:10701:634421:11370:1780235:10821:1066260:11216:89253:10033:1586229:7371:1453356:10316:3188874:11493:2123414:11490:763777:10756:1883271:10938:632609:10052:591049:11226:422608:2920:35433:9411:1855470:10590:1242303:11604:50824:9576:1109009:7133:926509:10889:11511:10700:591182:10643:547637:11266:288826:7763:224989:5587:129424:7492:848548:6381:28800-49282:1242303:40404:2230709:48599:596874
abetterinternet.com/
0
223484416
29793404
228623376
29719894
*
fme
1-25168:2:180.455-8083:2:161.052-6542:27:181.226-18062:1:165.015-6465:9:172.189-19234:2:158.077-25952:8:163.061-23499:12:178.087-6467:17:169.280-7985:99:180.488-6470:17:177.426-8081:3:180.330-8080:1:168.055-775:23:179.342-6473:10:175.296-6466:109:181.223-8082:19:180.390-6459:3:164.486-6633:3:174.359-22766:5:172.215-6472:3:172.375-6468:7:177.045-7974:11:164.494-8990:1:157.053-6471:6:169.089-137641:1:172.138-763:1:172.119-6187:5:180.148
abetterinternet.com/
0
223484416
29793404
228783376
29719894
*
hst
1-1120123353-0:45362:109143:imp-277:48619:9377:imp-1204:45366:53203:imp
abetterinternet.com/
0
223484416
29793404
228783376
29719894
*
dmg
%13%7E_d%152%08k%22%7Et%24%7Cv%22%7Eq%7Cwpm%7Exz%24evo%22%26%26*%2F%2C%24%7E%7C%22%26%2F%28%24ls%7B%22%7E%7Cl%7Es%7Elt%7E%24ks%7B%22qzk%24%7Br%7E%22%28%2B%2C%24%7Ck%22%7Bls%24sl%22rz%7Bvjr%24%7C%7B%22..-%2F%5E%3CN%3CI%25_
abetterinternet.com/
0
223484416
29793404
228783376
29719894
*
  • 0

#3
TomNJ
Posted 30 June 2005 - 10:55 AM

TomNJ

    Visiting Staff

  • Member
  • PipPipPip
  • 436 posts
Welcome to GeeksToGo :tazz: My name is Tom. I'm working on your log, as soon as another staff member reviews it I'll post a reply. Thank you for your patience.
  • 0

#4
TomNJ
Posted 30 June 2005 - 12:48 PM

TomNJ

    Visiting Staff

  • Member
  • PipPipPip
  • 436 posts
Please download Nailfix from here:
http://www.noidea.us...050515010747824
Unzip it to the desktop but please do NOT run it yet.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

For additional help in booting into Safe Mode, see the following site:
http://www.pchell.co.../safemode.shtml

Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Next please run HijackThis, click Scan, and check:

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe (file missing)

Close all open windows except for HijackThis and click Fix Checked.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.
  • 0

#5
TomNJ
Posted 08 July 2005 - 05:12 PM

TomNJ

    Visiting Staff

  • Member
  • PipPipPip
  • 436 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member with address of this thread. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP