Home Mail MemberMap Chat (0) Wallpapers
Go Back   ChiefsPlanet > The Royal Lounge > Media Center

Reply
 
Thread Tools Display Modes
Old 08-18-2010, 12:28 AM  
Bearcat Bearcat is offline
Rock Chalk
 
Bearcat's Avatar
 
Join Date: Nov 2000
Location: Kansas City
Casino cash: $6756
The Official Malware/Antivirus Thread - Need help or general advice? Read this first!

This thread provides information on malware removal, links to malware removal tools, and recommendations & links to anti-virus software. The intention of this thread is to provide quick and accurate support for malware-related issues and questions.

Many people here are willing to provide assistance if you're having computer problems, and this thread is not meant to discourage people from asking for help.... but, please read the information provided first, or else there's a good chance you'll be sent here, here, or here . We aren't Geek Squad, so while we won't grossly overcharge you for information and advice, we also aren't responsible for anything you do to your computer.

Also, feel free to make suggestions on the content of this post, and I'll try to keep it up to date.

Research


A lot of information can be found at this EliteKiller link, including...
  • Links to recommended malware scanning & removal tools, including the Rogue Removal Kit (which includes combofix), malwarebytes (aka MBAM), and Hitman Pro.
  • A link to HiJackThis, which creates a log of registry entries, running services, etc; that can be posted here for additional support.
  • Reviews, recommendations, and links to antivirus software, on-demand scanners, and online scanners.
  • Information on firewalls and unsecured networks, as well as malware/virus prevention.

Malware Removal

If you think your computer is infected, the EliteKiller link provides a thorough solution. Simply put...

Quote:
Originally Posted by mikeyis4dcats. View Post
Step 1 go here http://www.elitekiller.com/malware.htm and read up

Step 2 download the Rogue Removal Kit http://www.elitekiller.com/files/rogueremoval.zip

Step 3 unzip the Kit, read the instruction file and run the tools in the order given.

Step 4 Thank me in about 3 hours for fixing your shit.

The Rogue Removal Kit is is a zipped file that includes malwarebytes, CCleaner (a registry cleaner that will also delete temporary files), Combofix, Hitman Pro, and HiJackThis (HiJackThis is optional, see below). The instructions guide you through running these tools in Safe Mode With Networking; then running malwarebytes and an online scanner in Normal Mode.

Some people don't recommend running Combofix unless you're fairly certain you need to use it, but I've never heard of people having major problems with it. Here's a list of symptoms to Vundo infections, which may help determine if you need to run Combofix. You can also look here to see instructions with screenshots on how to use Combofix.

Taken from the readme in the Rogue Removal Kit:

Quality Online Virus Scanners: (all scanners offer detection and removal)


F-Secure
NOD32
Bitdefender

Quality Free Anti-Virus Software:

Panda Cloud
Microsoft Security Essentials
Antivir
Avast!
AVG


My two cents on downloading anti-malware software...
  • Download it from another computer if possible, or from Safe Mode With Networking on the infected machine.
  • Verify you are downloading from a legit source and are not being redirected to a site where you'll end up downloading more malware. If you click on any links above, verify the link in the bottom left before clicking on it, then after clicking the link verify that's where you were taken in the address bar.
  • The elitekiller article mentions downloading the software to a USB drive. Do not download the software to a USB drive on the infected machine if you're not in Safe Mode, or else you risk infecting the USB drive and other computers you connect the drive to in the future.

Other Helpful Tips & Tools

Rkill will kill processes that may be preventing scanners from completely removing malware.

To get into Safe Mode With Networking, press F8 every couple of seconds while the computer is starting (before the Windows splash screen). If you see the Windows splash screen, you will need to try again. The safe thing to do is log into Windows, restart, and try pressing F8 several times before seeing the Windows splash screen. Alternatively, my advice that falls into the category of “what I'd do if it was my own computer, but wouldn't tell someone to do it if I worked in tech support” would be, if you didn't get into Safe Mode the first time and you're at the Windows splash screen, hold down the power button until the computer turns off. When you start the computer again, it should automatically ask you if you want to go into Safe Mode With Networking.

If you get a Blue Screen of Death after selecting Safe Mode With Networking, read the following posts on how to fix it:
http://blog.didierstevens.com/2006/06/22/save-safeboot/
http://blog.didierstevens.com/2006/0...ring-safeboot/
http://blog.didierstevens.com/2007/0...th-a-reg-file/


Still infected, or just want to make sure everything is okay?

HiJackThis is a tool that will create a log file that can be analyzed by geeks to see what is running on your computer. Install and run HiJackThis (preferably in Safe Mode With Networking), and select 'Do a system scan and save a log file'. You can then copy/paste the output to this thread, and with any luck, someone will stop by and let you know what you can delete. You can then checkmark the items in HiJackThis and click 'Fixed checked'.

If you don't get a quick response here or would rather do it yourself, you can also go to http://hijackthis.de/, which is an online analyzer for your HiJackThis log. Simply copy and paste the log into the text box and click the Analyze button. During my testing of the site, I found it wasn't perfect, especially when a proxy was setup (the visitor rating would be 'extremely nasty', but the site itself would say it was safe)... but, it's at least a good tool that can significantly shorten the time it takes to analyze the log, and it gives you an idea of which entries you can delete or at least Google/post here for further research.

You can also look at the responses to HiJackThis posts in this thread to get an idea of what is safe and what should be removed.


Windows Performance

A good starting point to knowing what processes and services are running on your computer is a HiJackThis log. There's also a lot of information that's only a Google search away.

To manage the process that start when Windows starts, use msconfig (Start button -> Run... -> msconfig -> Startup tab). This is a good resource on startup processes, and it includes a large database of startup processes with information on whether they're required to run Windows or if it's okay to uncheck them. You basically want processes that are in c:\Windows checked, and you can generally uncheck processes in c:\program files (but there are exceptions, like your antivirus), but do some research (Google, the provided links, this thread) if you're not sure. Adobe, Apple (including qttask, Boujour, AppleUpdater, etc), and any messenger program (unless you have it sign you in at startup) are always the first ones to get unchecked on my computer.

Services can be a little tougher to manage, because it's usually a much longer list, and it's not as simple as flipping them on or off. This is a great resource for managing Windows services (Start button -> Run... -> services.msc). Simply choose your version of Windows and then click on the Service Configuration link. It presents the default setup, a safe setup (what most people can use without any consequences), a tweaked setup for faster startup, and a bare bones setup for the super geek. There's also a Tweaks page for stuff like Adding/Removing programs and System Restore.

Last edited by Bearcat; 03-27-2012 at 04:07 PM..
Posts: 27,169
Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.
  Reply With Quote
Old 01-11-2011, 01:46 PM   #76
Sofa King Sofa King is offline
Is winter over yet?
 
Sofa King's Avatar
 

Join Date: Nov 2008
Location: South Dakota
Casino cash: $5705
well SOB.
Posts: 18,764
Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.
  Reply With Quote
Old 01-11-2011, 01:46 PM   #77
Otter Otter is offline
holding a blood clot at birth
 
Otter's Avatar
 

Join Date: Sep 2000
Location: Durango, CO
Casino cash: $6508
Quote:
Originally Posted by Sofa King View Post
Well, i got a big problem...


Got something on the other comp, malwarebytes didn't pick it up, but symantec did. got one of the two it was messing with in quarantine, but it is giving me major RAM, memory, and hard drive not found errors.

Files are missing from my documents, i tried sticking in a usb card, but apparanantly it was instantly corrupted, so no dice adding anymore anti viruses.

keeps trying to get me to "defrag" using "Good Memory", whatever the hell that is... looks like a fake defrag/antivirus program.

Any ideas? i can't get into safe mode either... says windows vista, and i have XP
Can you post a HiJackThis file?
__________________
The democracy will cease to exist when you take away from those who are willing to work and give to those who would not - Thomas Jefferson, 1801.
Posts: 13,125
Otter has enough rep power to blowy ou to bits.Otter has enough rep power to blowy ou to bits.Otter has enough rep power to blowy ou to bits.Otter has enough rep power to blowy ou to bits.Otter has enough rep power to blowy ou to bits.Otter has enough rep power to blowy ou to bits.Otter has enough rep power to blowy ou to bits.Otter has enough rep power to blowy ou to bits.Otter has enough rep power to blowy ou to bits.Otter has enough rep power to blowy ou to bits.Otter has enough rep power to blowy ou to bits.
  Reply With Quote
Old 01-11-2011, 01:47 PM   #78
Sofa King Sofa King is offline
Is winter over yet?
 
Sofa King's Avatar
 

Join Date: Nov 2008
Location: South Dakota
Casino cash: $5705
Quote:
Originally Posted by BigRedChief View Post
Didn't your XP come with a "restore" option? Just go in there and restore to a time before these events started occuring.
when i hit F8 and tried to bring up the list for safe mode, it instead brought me to a 2 selection screen. either Windows Vista (which is not what i have) or memory diagnostic, which does give me the option to restart with the installation disk and try to repair, but i don't know if that will screw things up worse or not.
Posts: 18,764
Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.
  Reply With Quote
Old 01-11-2011, 01:48 PM   #79
Sofa King Sofa King is offline
Is winter over yet?
 
Sofa King's Avatar
 

Join Date: Nov 2008
Location: South Dakota
Casino cash: $5705
Quote:
Originally Posted by Otter View Post
Can you post a HiJackThis file?
negative. i didn't have it installed because i thought malwarebytes was the almighty.

now i can't get into safe to download it, and it wont let me do it out of safe mode either.
Posts: 18,764
Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.
  Reply With Quote
Old 01-11-2011, 02:00 PM   #80
Fish Fish is offline
Missing Dick Curl
 
Fish's Avatar
 

Join Date: Sep 2005
Casino cash: $7323
Quote:
Originally Posted by Sofa King View Post
when i hit F8 and tried to bring up the list for safe mode, it instead brought me to a 2 selection screen. either Windows Vista (which is not what i have) or memory diagnostic, which does give me the option to restart with the installation disk and try to repair, but i don't know if that will screw things up worse or not.
Hmmm.... Are you sure you don't have a CD or DVD in your drive that it's trying to boot to? Or another HD with a Vista install on it? This is really bizarre...
__________________
Posts: 25,846
Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.
  Reply With Quote
Old 01-11-2011, 02:08 PM   #81
Sofa King Sofa King is offline
Is winter over yet?
 
Sofa King's Avatar
 

Join Date: Nov 2008
Location: South Dakota
Casino cash: $5705
Quote:
Originally Posted by KC Fish View Post
Hmmm.... Are you sure you don't have a CD or DVD in your drive that it's trying to boot to? Or another HD with a Vista install on it? This is really bizarre...
Positive there's no cd in there.




any idea on the "memory" defrag/anti virus stuff?
Posts: 18,764
Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.
  Reply With Quote
Old 01-11-2011, 02:23 PM   #82
Bearcat Bearcat is offline
Rock Chalk
 
Bearcat's Avatar
 

Join Date: Nov 2000
Location: Kansas City
Casino cash: $6756
Quote:
Originally Posted by Sofa King View Post
negative. i didn't have it installed because i thought malwarebytes was the almighty.

now i can't get into safe to download it, and it wont let me do it out of safe mode either.
Yeah, the Safe Mode issue is strange... you might check out the 2nd to last section in the OP about the BSoD when going into Safe Mode. It does seem like something else is going on, but you might try restoring those registry keys and trying again.

What do you mean by it won't let you download it? Are you being redirected when you click the link in the OP, you can't connect to the internet, you can download it but can't install it... ?

This link includes HiJackThis... http://www.elitekiller.com/files/rogueremoval.zip

You might need to find a recordable CD or DVD... you could download and burn them from another computer, and try installing them that way.
__________________
Posts: 27,169
Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.Bearcat has an IQ even higher than Frankie's.
  Reply With Quote
Old 01-11-2011, 02:48 PM   #83
Sofa King Sofa King is offline
Is winter over yet?
 
Sofa King's Avatar
 

Join Date: Nov 2008
Location: South Dakota
Casino cash: $5705
Alrighty. I did a system restore, and it got rid of some of the issues, except now my symantec, which was the only thing that found something, is disabled and i can't get it turned back on.

Now i have managed to get my stuff off of my usb card, so now i have a hijack this report, but i'm very leary about hooking that comp back up to the internet. the whole "your private data is at risk" warning made me gun shy.

any idea what i should look for in the report? i'm trying to find a way to print it, scan it, and then upload the scan to the other comp, but no luck so far.
Posts: 18,764
Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.
  Reply With Quote
Old 01-11-2011, 03:12 PM   #84
Sofa King Sofa King is offline
Is winter over yet?
 
Sofa King's Avatar
 

Join Date: Nov 2008
Location: South Dakota
Casino cash: $5705
just occured to me... my scanner is hooked up to the bad comp... FML...

i'm not going to transfer this to my billing comp...
Posts: 18,764
Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.
  Reply With Quote
Old 01-11-2011, 04:40 PM   #85
Fish Fish is offline
Missing Dick Curl
 
Fish's Avatar
 

Join Date: Sep 2005
Casino cash: $7323
Quote:
Originally Posted by Sofa King View Post
Alrighty. I did a system restore, and it got rid of some of the issues, except now my symantec, which was the only thing that found something, is disabled and i can't get it turned back on.

Now i have managed to get my stuff off of my usb card, so now i have a hijack this report, but i'm very leary about hooking that comp back up to the internet. the whole "your private data is at risk" warning made me gun shy.

any idea what i should look for in the report? i'm trying to find a way to print it, scan it, and then upload the scan to the other comp, but no luck so far.
The bug might have hosed Symantec. You may have to reinstall it.

It's not really worth it to try and tell you what to look for in your HijackThis log. There's too many possibilities to begin. We'll have to look at it and see what doesn't belong, as opposed to telling you what could be there. But I don't think you have anything to worry about by hooking it back up to the internet. The "Your private data is at risk" statement is slightly over dramatized. A HijackThis log only collects system and application data. It doesn't really do anything else. It will show every program that's running on your computer at that moment. That's about as personal as the information gets. There's zero harm in doing so, unless you just don't want people to know what apps you're running.
__________________
Posts: 25,846
Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.
  Reply With Quote
Old 01-11-2011, 04:52 PM   #86
Sofa King Sofa King is offline
Is winter over yet?
 
Sofa King's Avatar
 

Join Date: Nov 2008
Location: South Dakota
Casino cash: $5705
i forgot i had this pile of crap laptop. i don't care if this things blows up, so i transfered the info the the card and took it home.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 4:51:33 PM, on 1/11/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.17093)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sharp\Button Manager T\btnman.exe
F:\rogueremoval\HiJack This\HijackThis.exe
C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
F:\rogueremoval\Sysinternals\ProcessExplorer\procexp.exe
C:\Program Files\Symantec\Symantec Endpoint Protection\SescLU.exe
C:\WINDOWS\explorer.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USREL/1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.live.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://g.msn.com/USREL/1
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:59274
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Sharp Button Manager T.lnk = C:\Program Files\Sharp\Button Manager T\btnman.exe
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1250961608046
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{83B5B9D7-CF40-4A93-849D-3652116F7768}: NameServer = 64.251.191.5,64.251.160.2
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

--
End of file - 7452 bytes
Posts: 18,764
Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.
  Reply With Quote
Old 01-11-2011, 04:53 PM   #87
Sofa King Sofa King is offline
Is winter over yet?
 
Sofa King's Avatar
 

Join Date: Nov 2008
Location: South Dakota
Casino cash: $5705
perhaps a dumb question, but if i turn the internet back on that comp, can the virus/whatever transfer basically anything they want to from the comp? can they transfer anything? info, saved passwords, etc?
Posts: 18,764
Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.Sofa King is obviously part of the inner Circle.
  Reply With Quote
Old 01-11-2011, 04:55 PM   #88
Mr. Laz Mr. Laz is offline
Don't Tease Me
 
Mr. Laz's Avatar
 

Join Date: Dec 2000
Location: KS
Casino cash: $9197
Quote:
Originally Posted by Sofa King View Post
perhaps a dumb question, but if i turn the internet back on that comp, can the virus/whatever transfer basically anything they want to from the comp? can they transfer anything? info, saved passwords, etc?
Yes, if that is what the virus is programmed to do.
Posts: 82,304
Mr. Laz is obviously part of the inner Circle.Mr. Laz is obviously part of the inner Circle.Mr. Laz is obviously part of the inner Circle.Mr. Laz is obviously part of the inner Circle.Mr. Laz is obviously part of the inner Circle.Mr. Laz is obviously part of the inner Circle.Mr. Laz is obviously part of the inner Circle.Mr. Laz is obviously part of the inner Circle.Mr. Laz is obviously part of the inner Circle.Mr. Laz is obviously part of the inner Circle.Mr. Laz is obviously part of the inner Circle.
  Reply With Quote
Old 01-11-2011, 05:09 PM   #89
Fish Fish is offline
Missing Dick Curl
 
Fish's Avatar
 

Join Date: Sep 2005
Casino cash: $7323
Quote:
Originally Posted by Sofa King View Post
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:59274
Looks like you have a proxy server set. If you didn't intentionally set that, you might want to turn it off.

Go to Control Panel\Internet Options\Connections\LAN settings
Uncheck the box that says Use Proxy server at the bottom.
The only thing on that LAN settings page that should be checked is Automatically detect settings.

Other than that, your log file looks pretty clean. Nothing really sticks out.
__________________
Posts: 25,846
Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.
  Reply With Quote
Old 01-11-2011, 05:17 PM   #90
Fish Fish is offline
Missing Dick Curl
 
Fish's Avatar
 

Join Date: Sep 2005
Casino cash: $7323
Quote:
Originally Posted by Sofa King View Post
perhaps a dumb question, but if i turn the internet back on that comp, can the virus/whatever transfer basically anything they want to from the comp? can they transfer anything? info, saved passwords, etc?
Not really. In the old days, there were apps like Back Orifice, in which you could do stuff like that. But it's been patched since the days of Win95. To do what you're indicating, someone would have to have physical access to the computer and manually load things without your knowledge. You're not going to catch a bug while watching gay midget porn that would have the capabilities of that. It's possible, but so unlikely that you shouldn't worry about it.
__________________
Posts: 25,846
Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.Fish is obviously part of the inner Circle.
  Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On

Forum Jump




All times are GMT -6. The time now is 05:55 AM.


This is a test for a client's site.
A new website that shows member-created construction site listings that need fill or have excess fill. Dirt Monkey @ https://DirtMonkey.net
Powered by vBulletin® Version 3.8.0
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.