Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

My Recent Incident and G2G's fix...it worked?


  • Please log in to reply

#1
jwramc

jwramc

    New Member

  • Member
  • Pip
  • 2 posts
Hello,

I'm a brand-newbie here, referred by an online pal who pointed me toward one these threads to solve my recent malware issues.

To begin, I'll post the same message I posted elsewhere, looking for aid. It will be followed by a link to a G2G thread offering solutions to a similar incident.

I asked:

"Sorry for the OT, but I know some of you folks are FAR
more in the know about computer threats/security and
adware/virus issues. PLEASE respond directly to my Email
address so everyone else doesn't have to read every
response.

I was out searching for some downloadable software to
'rip' audio from concert DVDs to MP3 files. I found only
one that seemed to be mentioned everywhere called DVD
Audio Ripper (as obvious a title if there ever was one),
and downloaded and installed it. It did all I wanted so
I revisited the site to 'buy' the unlock code. The site
wasn't responding and in my impatience, and at the urging
of my neighbor's kid, I went searching for the 'crack'...
and apparently fell into one.

I landed on a 'site' that instantly caused multiple browser
windows to open and I couldn't shut them off as fast as
they opened. I bailed off the site and killed everything,
logged off, rebooted and then tried to go online again.
That's when the first obvious sign that 'something malicious
this way came'. My network connection window opened (yes,
still on dial-up) and showed a gibberish phone number in
place of the usual one. I checked and found my user name
also altered. I presumed the password was also different.
Apparently, the attempt was made to have me dialup some
foreign number and login to their server so they could
access my system directly. I changed all the info back and
logged on just fine. I found out later when I logged off
again, the altered numbers automatically reinserted
themselves. Now I'm having to fix it every time I wish to
log on.

The second issue, probably related, is that once I log on and
open IE's browser, a second window opens automatically. I
Haven't let it fully load to display what it plans to, but
I suspect it's been linked to open with IE and is the 'program'
that is resetting my connection to the malicious phone number
and login info...but that's a guess.

Other issues that have also arisen include insanely slow CD
burning (Nero) and an occasional 5 to 10 minute startup time
for MS Outlook. Just walk away...it'll finish loading eventually.

Throughout all this, I have a very-current McAfee Firewall and
Virus package, plus I'm running AdAware Plus daily. AdAware
found A pile of critical items the first time it ran, but the cleanup
did not affect the issues I've detailed above. McAfee has found
nothing.

Soooo.....anybody got a good idea what went wrong (other than my
thought processes)? Solutions (other than format and reinstall...
grr!)? All ideas appreciated.

BTW- I did finally get back to the software site, paid and got my
code. Lesson learned (again)."

In reply, a pal sent me this link:
http://www.geekstogo...showtopic=50788

I downloaded the recommended SW, namely-
HiJack This
Ewido Security Suite
CCleaner
and
NailFix

I then followed the first batch of instructions to use all of those applications.

At this time, I **think** my troubles have vanished, but I'll post my HJT log next, just to have a more knowledgeable PCer determine if my issues are over... or there's more work neded.

Thanks in advance.

The log follows in a seperate reply.
  • 0

Advertisements


#2
jwramc

jwramc

    New Member

  • Topic Starter
  • Member
  • Pip
  • 2 posts
Logfile of HijackThis v1.99.1
Scan saved at 1:16:31 PM, on 9/14/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
D:\My Documents\My Software\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - d:\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [Local Security Authority Service] C:\WINDOWS\System32\lssas.exe
O4 - Global Startup: NkbMonitor.exe.lnk = D:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: YExplorer1_8US.CAB - http://photos.groups...plorer1_8us.cab
O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab
O16 - DPF: {43331111-1111-1111-1111-611111195622} - file://c:\ex.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O23 - Service: ewido security suite control - ewido networks - d:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP