Author Topic: Viruses in system32 folder  (Read 53975 times)

0 Members and 1 Guest are viewing this topic.

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67185
Re: Viruses in system32 folder
« Reply #75 on: April 18, 2007, 04:46:06 AM »
I could just get SP2 from one of my friends.
You'll need a legit key again... or to crack your system (or installation CD).
The best things in life are free.

Steven6767

  • Guest
Re: Viruses in system32 folder
« Reply #76 on: April 18, 2007, 04:54:00 AM »
I ran vundo but no files came up. Is that bad or good? :P

mauserme

  • Guest
Re: Viruses in system32 folder
« Reply #77 on: April 18, 2007, 04:56:09 AM »
That's very good  :)

Polonus asked about a fresh hjt log and Tech an online scan.  If you're not completely fed up with us ...

Well, if you tell me your computer is running better and the firewall isn't driving you crazy with connection attempts I'm good with that.
« Last Edit: April 18, 2007, 05:03:20 AM by mauserme »

Steven6767

  • Guest
Re: Viruses in system32 folder
« Reply #78 on: April 18, 2007, 04:58:18 AM »
Haha, ok well im gonna go then, i'll keep trying to get SP2, hopefully i'll get it soon. But for now i'll keep my computer on lockdown  :P

mauserme

  • Guest
Re: Viruses in system32 folder
« Reply #79 on: April 18, 2007, 04:59:33 AM »
Sorry - edited in a little extra above.

Is the computer running well now?   And the firewall is at peace?

Steven6767

  • Guest
Re: Viruses in system32 folder
« Reply #80 on: April 18, 2007, 05:03:41 AM »
Yea the firewalla is doing fine I guess, for games online games its a pain in the butt, but it's fine once I let them through. Yea, I'll get the Hjt log, and the online scan done tommorow, i'll reply with the results. Thanks for all the help, I think my computer would have crashed by now if it wasn't for you haha.

mauserme

  • Guest
Re: Viruses in system32 folder
« Reply #81 on: April 18, 2007, 05:06:02 AM »
You're welcome. 

I'll take a look at your log tomorow but I think your just fine now.

Steven6767

  • Guest
Re: Viruses in system32 folder
« Reply #82 on: April 18, 2007, 05:06:16 AM »
My computer I think is running a lot better, especially without all those annoying virus popups every 5 seconds.

Steven6767

  • Guest
Re: Viruses in system32 folder
« Reply #83 on: April 18, 2007, 05:07:13 AM »
Ok i'll talk to you later.

mauserme

  • Guest
Re: Viruses in system32 folder
« Reply #84 on: April 18, 2007, 05:07:20 AM »
My computer I think is running a lot better, especially without all those annoying virus popups every 5 seconds.
You didn't like those?  :P

Steven6767

  • Guest
Re: Viruses in system32 folder
« Reply #85 on: April 19, 2007, 11:14:31 PM »
Sorry for not replying, I'll get everything done tonight (hopefully) so we can be done with this :P , unless my brother steals the computer for a while.

Steven6767

  • Guest
Re: Viruses in system32 folder
« Reply #86 on: April 20, 2007, 09:03:11 PM »
Ok, i've finally finished everything, my computer acording to the scan is clean, and heres the Hjt log.

Logfile of HijackThis v1.99.1
Scan saved at 4:01:01 AM, on 4/20/2007
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O20 - AppInit_DLLs: 
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ieupdater2 (Microsoft IEUpdater2) - Unknown owner - C:\ie_updater.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe

Offline essexboy

  • Malware removal instructor
  • Avast √úberevangelist
  • Probably Bot
  • *****
  • Posts: 40589
  • Dragons by Sasha
    • Malware fixes
Re: Viruses in system32 folder
« Reply #87 on: April 20, 2007, 11:10:08 PM »
O23 - Service: ieupdater2 (Microsoft IEUpdater2) - Unknown owner - C:\ie_updater.exe (file missing)

NASTY Trojan Backdoor QGB

I would recommend before trying to kill this getting updated to SP1 otherwise you will be continually getting re-infected

Steven6767

  • Guest
Re: Viruses in system32 folder
« Reply #88 on: April 20, 2007, 11:52:34 PM »
I know i'm hoping to get it soon 8)

mauserme

  • Guest
Re: Viruses in system32 folder
« Reply #89 on: April 21, 2007, 04:54:15 AM »
O23 - Service: ieupdater2 (Microsoft IEUpdater2) - Unknown owner - C:\ie_updater.exe (file missing)

NASTY Trojan Backdoor QGB

I would recommend before trying to kill this getting updated to SP1 otherwise you will be continually getting re-infected

We already got rid of the file with SDFix but it's still registered as a service.  It used to read

Quote
O23 - Service: ieupdater2 (Microsoft IEUpdater2) - Unknown owner - C:\ie_updater.exe /start

Running "sc delete Microsoft IEUpdater2" from the command line didn't unregistered it.  Should it be "sc delete ieupdater2" instead?
« Last Edit: April 21, 2007, 05:29:19 AM by mauserme »