Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Spyware.Look2me [RESOLVED]

Started by Tiyok , Nov 25 2005 03:39 AM

  • This topic is locked This topic is locked

#16
OwNt
Posted 04 December 2005 - 09:33 PM

OwNt

    Malware Expert

  • Retired Staff
  • 7,457 posts
Hello, Tiyok.

Ok, first things first.

Please open Hijackthis, scan, and place a checkmark by the following entries:

O4 - HKLM\..\Run: [Microsoft Telecoma Center] tellcoma.exe
O4 - HKLM\..\RunServices: [Microsoft Telecoma Center] tellcoma.exe
O4 - HKCU\..\Run: [Microsoft Telecoma Center] tellcoma.exe

Close all open windows/browsers and click Fix Checked.

Exit Hijackthis.

Then reboot into Safe Mode by tapping F8 as your computer turns on. Select safe mode from the list that appears.

Once in safe mode please delete the following file:

C:\WINDOWS\System32\tellcoma.exe

Then reboot back into normal mode.

Then let's get rid of the spam...

If your on XP Home follow these instructions.
  • Click Start->Settings ->Control Panel
  • Click Performance and Maintenance
  • Click Administrative Tools
  • Double click Services Scroll
  • down and highlight "Messenger"
  • Right-click the highlighted line and choose Properties.
  • Click the STOP button.
  • Select Disable or Manual in the Startup Type scroll bar
  • Click OK
If you are on XP Pro, follow these.
  • Click Start->Settings ->Control Panel
  • Click Administrative Tools
  • Click Services
  • Double click Services Scroll
  • down and highlight "Messenger"
  • Right-click the highlighted line and choose Properties.
  • Click the STOP button.
  • Select Disable or Manual in the Startup Type scroll bar
  • Click OK
As for Java...

Install the newest one Here and reboot.

Also, post back a fresh Hijackthis log as well please.

Now how is your system running?
  • 0

Advertisements

#17
Tiyok
Posted 05 December 2005 - 04:05 AM

Tiyok

    Member

  • Topic Starter
  • Member
  • PipPip
  • 28 posts
there is no such file in :
C:\WINDOWS\System32\tellcoma.exe
so i couldnt delete it.

i dont know how to install java in the link you gave me but i disabled messenger. and there is no more error message so far.

Logfile of HijackThis v1.99.1
Scan saved at 17:01:18, on 05/12/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Opera\opera.exe
C:\Documents and Settings\lentera nuansa\My Documents\Tiyok\hijackthis\HijackThis.exe

F1 - win.ini: run=C:\WINDOWS\..\PROGRA~1\COMMON~1\MICROS~1\MSInfo\
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [OESpamTest] C:\PROGRA~1\KASPER~1\KASPER~1\KASPER~3\OESpamTest.ExE
O4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = telkom
O17 - HKLM\Software\..\Telephony: DomainName = telkom
O17 - HKLM\System\CCS\Services\Tcpip\..\{C0553B3A-2378-4681-B68F-C767321AF61B}: NameServer = 202.134.0.155 202.134.2.5
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = telkom
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = telkom
O23 - Service: CPUCooLServer Service (CPUCooLServer) - Unknown owner - C:\Program Files\CPUCooL\CooLSrv.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: JRun Service Manager (jsm-default) - Unknown owner - C:\Program Files\Macromedia\Generator 2\bin\jsm.exe
O23 - Service: kavsvc - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Security Suite\Kaspersky Anti-Spam Personal\KAV\KAVSVC.exe (file missing)
O23 - Service: Informix Dynamic Server Message Service (MsgServ) - Unknown owner - C:\WINDOWS\System32\msgserv.exe (file missing)
O23 - Service: Windows Update 64 (nbupd64) - Unknown owner - C:\WINDOWS\System32\nbupd64.exe" -netsvcs (file missing)
O23 - Service: ISM Server (nsrd) - Unknown owner - C:\ISM\2.20\bin\nsrd (file missing)
O23 - Service: ISM Local Execution (nsrexecd) - Unknown owner - C:\ISM\2.20\bin\nsrexecd (file missing)
O23 - Service: Informix IDS - ol_desknote (ol_desknote) - Unknown owner - C:\PROGRA~1\Informix\bin\onscpah.exe
O23 - Service: ISM Portmapper (portmap) - Unknown owner - C:\ISM\2.20\bin\portmap (file missing)
  • 0

#18
OwNt
Posted 05 December 2005 - 01:01 PM

OwNt

    Malware Expert

  • Retired Staff
  • 7,457 posts
Hello, Tiyok.

1) Please download the Killbox.
Unzip it to the desktop but do NOT run it yet.

2) Please run Killbox.

3) Select "Delete on Reboot".

4) Open the text file with these instructions in it, and copy the file names below to the clipboard by highlighting them and pressing Control-C:

C:\WINDOWS\System32\tellcoma.exe

5) Return to Killbox, go to the File menu, and choose "Paste from Clipboard".

6) Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again..

Let the system reboot.

Let me know if you have any more problems, then we can commence the final cleanup procedures.

Edited by OwNt, 05 December 2005 - 10:04 PM.

  • 0

#19
Tiyok
Posted 05 December 2005 - 09:45 PM

Tiyok

    Member

  • Topic Starter
  • Member
  • PipPip
  • 28 posts
"4) Open the text file with these instructions in it, and copy the file names below to the clipboard by highlighting them and pressing Control-C:

put files here in a box."

what text file ? what file names to copy?
  • 0

#20
OwNt
Posted 05 December 2005 - 10:05 PM

OwNt

    Malware Expert

  • Retired Staff
  • 7,457 posts
Hello, Tiyok.

Sorry about that, it's fixed now.
  • 0

#21
Tiyok
Posted 05 December 2005 - 10:12 PM

Tiyok

    Member

  • Topic Starter
  • Member
  • PipPip
  • 28 posts
what do you mean it's fixed now? my pc is clean now?
  • 0

#22
OwNt
Posted 05 December 2005 - 10:16 PM

OwNt

    Malware Expert

  • Retired Staff
  • 7,457 posts
Hello, Tiyok.

I meant I fixed the instructions.

1) Please download the Killbox.
Unzip it to the desktop but do NOT run it yet.

2) Please run Killbox.

3) Select "Delete on Reboot".

4) Open the text file with these instructions in it, and copy the file names below to the clipboard by highlighting them and pressing Control-C:

C:\WINDOWS\System32\tellcoma.exe

5) Return to Killbox, go to the File menu, and choose "Paste from Clipboard".

6) Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again..

Let the system reboot.

Let me know if you have any more problems, then we can commence the final cleanup procedures.
  • 0

#23
Tiyok
Posted 05 December 2005 - 10:41 PM

Tiyok

    Member

  • Topic Starter
  • Member
  • PipPip
  • 28 posts
ok i did it and there is no problem. what now?
  • 0

#24
OwNt
Posted 05 December 2005 - 10:47 PM

OwNt

    Malware Expert

  • Retired Staff
  • 7,457 posts
Hello, Tiyok.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
  • Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.

    You can find instructions on how to enable and reenable system restore here:

    Managing Windows Millenium System Restore

    or

    Windows XP System Restore Guide

    Reenable system restore with instructions from tutorial above

  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
      • Change the Download signed ActiveX controls to Prompt
      • Change the Download unsigned ActiveX controls to Disable
      • Change the Initialize and script ActiveX controls not marked as safe to Disable
      • Change the Installation of desktop items to Prompt
      • Change the Launching programs and files in an IFRAME to Prompt
      • Change the Navigate sub-frames across different domains to Prompt
      • When all these settings have been made, click on the OK button.
      • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
  • Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

    See this link for a listing of some online & their stand-alone antivirus programs:

    Virus, Spyware, and Malware Protection and Removal Resources

  • Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

    For a tutorial on Firewalls and a listing of some available ones see the link below:

    Understanding and Using Firewalls

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

  • Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

    A tutorial on installing & using this product can be found here:

    Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

  • Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

    A tutorial on installing & using this product can be found here:

    Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

  • Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

    A tutorial on installing & using this product can be found here:

    Using SpywareBlaster to protect your computer from Spyware and Malware

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

here are some additional utilities that will enhance your safety
  • IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
  • Google Toolbar <= Get the free google toolbar to help stop pop up windows.

  • 0

#25
Tiyok
Posted 05 December 2005 - 10:58 PM

Tiyok

    Member

  • Topic Starter
  • Member
  • PipPip
  • 28 posts
OK thank you very much!!!
My PC is clean and there is no more error message. You are great!
  • 0

Advertisements

#26
OwNt
Posted 05 December 2005 - 11:04 PM

OwNt

    Malware Expert

  • Retired Staff
  • 7,457 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :tazz:

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP