Topic: Virus/trojan help....hijackthis log inside (Read 2693 times)

d112crzy · « **on:** December 03, 2009, 12:23:04 AM »

Both my brothers computer and my laptop just got the same trojan(on the same network). We both have Avast anti virus installed. He immediately disconnected the internet on his to prevent anything further just in case. The modem doesn't have a password, but the wireless does have wep key, but I've heard those aren't really all that safe.

The first thing I did was dl hijackthis and ran a scan and got this. Now, Avast showed the trojan to be within spybot s&d. I tried running spybot, but avast stopped it. I also tried uninstalling it, and once again Avast stopped it. I disabled avast and was able to uninstall Spybot for safe measure. I then tried to access the Spybot website and it times out, with or without Avast enabled.

Any help would be appreciated. I can't lose this laptop, I've gone through too many and this is my last free Crome reg string I get.

Quote from: HiJackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:16:38 PM, on 12/2/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\S24EvMon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\IBMTOOLS\UTILS\ibmprc.exe
C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\WINDOWS\system32\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [S3TRAY2] S3Tray2.exe
O4 - HKLM\..\Run: [trackPointSrv] tp4serv.exe
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UC_Start] C:\Program Files\IBM\Updater\\ucstartup.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
O4 - HKLM\..\Run: [QCWLICON] C:\Program Files\ThinkPad\ConnectUtilities\QCWLICON.EXE
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [JAVA_IBM] Java (IBM)
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 8192 bytes

1991civicsi · « **Reply #1 on:** December 03, 2009, 12:25:23 AM »

I had Steve help me a while back, hit him up.

bigwig · « **Reply #2 on:** December 03, 2009, 12:28:37 AM »

Malware Antibytes
Super AntiSpyware

Just run both of those and you should be 98% back to normal. If the computer is good enough, start running your internet browsers in a Sandbox(google it) and you will have a lot less issues.

1991civicsi · « **Reply #3 on:** December 03, 2009, 12:32:39 AM »

Malware was one free program that had gotten rid of my Rogue Virus

jagojon3 · « **Reply #4 on:** December 03, 2009, 12:36:25 AM »

I believe the two of you are referring to Malwarebytes Antispyware which is a great program.

Using that along with Super-Antispyware and Spybot I can get rid of just about anything. Make sure you also set it to run a scan at system startup.

Ravage70 · « **Reply #5 on:** December 03, 2009, 12:37:01 AM »

I would format and restart especially if this PC is used for banking/shopping online.

bigwig · « **Reply #6 on:** December 03, 2009, 12:39:54 AM »

I will say that no matter what, your computer will not be 100% after you get a few good infections. Sooner or later, a reformat will be in your future. After having this laptop for several years now and going through several infections, it's due for it's second reformat.

PS: If you want, you can find a serial code VERY easily for Malwarebytes which will allow real time protection and IP protection. Buying the program is not that expensive either.

d112crzy · « **Reply #7 on:** December 03, 2009, 12:48:33 AM »

I actually have both those programs on the desktop, just not on my laptop. Dl'ing them now.

Also, it seems someone has somehow hacked into my qwest modem. The wireless light is fucking flickering like they're downloading the entire internet. I've changed the pw 2 times, changed the name as well. Even with my laptop not connected to it, the light is going fucking crazy.

Any way to stop this? It's a qwest wireless modem.

bigwig · « **Reply #8 on:** December 03, 2009, 12:55:39 AM »

Quote from: d112crzy on December 03, 2009, 12:48:33 AM

I actually have both those programs on the desktop, just not on my laptop. Dl'ing them now.

Also, it seems someone has somehow hacked into my qwest modem. The wireless light is fucking flickering like they're downloading the entire internet. I've changed the pw 2 times, changed the name as well. Even with my laptop not connected to it, the light is going fucking crazy.

Any way to stop this? It's a qwest wireless modem.

That's not happening. These types of infections are typically a lot less severe than people make them out to be. It's typically either some spyware that someone installs on your computer then asks you to pay to remove it. From there, they have your CC info, ect. The other is basically a data miner which grabs what kind of sites you look at and whats on your computer and transmits it back so gather data. Then a company processes all of that data and sells it to marketing firms so they can market their products better. The very small percentage is people hacking your bandwidth and trying to DIRECTLY steal your credit card/personal information. There are enough stupid people that give it away willingly that they don't have to do it otherwise.

d112crzy · « **Reply #9 on:** December 03, 2009, 01:06:07 AM »

But how is it possible that both computers got it at the same time, if it wasn't someone "hacking" into our modem. Idk, maybe I am over thinking this. But still weird.

bigwig · « **Reply #10 on:** December 03, 2009, 01:08:53 AM »

You both opened the same email saying "Hey, look at my big tits!"

d112crzy · « **Reply #11 on:** December 03, 2009, 01:11:57 AM »

Negative, he wasn't on the internet(he was connected though). he was watching a movie.

I was on AIM. The internet stopped working, then this happened.

It's saying Crome, eCtune and Hondata are trojans now. Well, I believe Hondata could be a virus.

bigwig · « **Reply #12 on:** December 03, 2009, 01:16:42 AM »

Quote from: d112crzy on December 03, 2009, 01:11:57 AM

Negative, he wasn't on the internet(he was connected though). he was watching a movie.

I was on AIM. The internet stopped working, then this happened.

It's saying Crome, eCtune and Hondata are trojans now. Well, I believe Hondata could be a virus.

The way those programs identify if they are legal is by sending packets of information back to a server. That is a very similar thing as what spyware does.

I've gotten stuff from watching streaming video. The site sells ad space. The ad space runs a script to load some software. The software gets in your computer.

I don't know how you guys are networked, but I think you should just use Malwarebytes and remove everything. Then go back and fix any issues you come across later(like reloading Crome, eCtune, and Hondata).

d112crzy · « **Reply #13 on:** December 03, 2009, 01:21:18 AM »

He's connected directly to the DSL modem, and I'm connected via wireless connection from the same modem.

Doug · « **Reply #14 on:** December 03, 2009, 01:22:16 AM »

I remember back in about 01 I was on the interwebz and a pop up box came up that I could type back into. Person was just talking all kind of gay nerd crap then my CD driver randomly started opening and closing. Shut off PC and back on and never happened again, but thought it was funny

crxvtec91 · « **Reply #15 on:** December 03, 2009, 01:23:41 AM »

Linux>windows

d112crzy · « **Reply #16 on:** December 03, 2009, 01:27:59 AM »

http://answers.yahoo.com/question/index?qid=20091202191236AA96njt

Seems like it just might be Avast tripping out. I sure hope so, because now it's saying my restore files are trojans.

It makes sense as to why this happened at exactly the same time on both computers.

Aero · « **Reply #17 on:** December 03, 2009, 02:18:15 AM »

http://www.ubcd4win.com/

Greatest tool ever for windows spyware/viruses that I've found.

keelay · « **Reply #18 on:** December 03, 2009, 02:40:36 AM »

Quote from: crxvtec91 on December 03, 2009, 01:23:41 AM

Linux>windows

Doug · « **Reply #19 on:** December 03, 2009, 04:19:29 AM »

Quote from: keelay on December 03, 2009, 02:40:36 AM

Quote from: crxvtec91 on December 03, 2009, 01:23:41 AM
Linux>windows

News:

Author Topic: Virus/trojan help....hijackthis log inside (Read 2693 times)

bigwig

bigwig

bigwig

bigwig

bigwig