Information Security Forum

I found this on my computer and can't seem to get rid of it, or find any thing about it. What do you think?

I have these annoying Aurora pop-ups. Please, advise what to do - I'll follow the steps exactly! Thank you :) Here is the HJT log with all windows and systray applications closed: Logfile of HijackThis v1.99.1 Scan saved at 4:50:25 PM, on 7/9/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: …

Crunchie.... I hope you're out there! I seem to have been caught. Here's a log from l2mfix and I'll post the next message with one from HJT. Thanks in advance! L2MFIX find log 1.03 These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows …

Hi there My norton keeps alerting me to the above trojan. So far I have tried: deleting the file from where I am told it is located C:\WINDOWS\ but it cannot be found even with hidden files shown. ending the process in task manager but cannot see it. locating it …

Hello, I just recently got Highjackthis and was wondering if someone could help me in what I should do in regards to this log. :o Logfile of HijackThis v1.98.0 Scan saved at 11:41:18 AM, on 7/9/2004 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: …

Ok Im a newbie but with searching for help for my problem I came across this forum..thank god! I seem to be having the same problem as everyone else with these popups. I did try and get rid of this but with mine I notice that when you end the …

Before scanning with Hijack This i scanned with trendmicro and adaware here is the logfile; help would be greatly appreciated my computer has become quite slow. Thanks. Logfile of HijackThis v1.99.1 Scan saved at 3:15:18 AM, on 7/11/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) …

Hey guys, welll, last Friday, I left my PC on all day , idle. I come back later that night, and I am infested with SpySheriff. I have not been able to get rid of it . I have done system restore, but 1 or 2 restarts later, it returns. …

Hi, Please could someone help me, I have something nasty in my PC. Every time I click send/receive on outlook, I get hundreds of un-delivered emails, its driving me round the bend. I have check with AVG, Aluria, CWS, Beta 1 and HJT. Is there anything in this log or …

i'm having a prob now..ermz..[B]msdiretx.sys[/B] keeps popping up on my avg nti virus software.what should i do about it?i deleted it,n it comes back.i've tried to search for the .exe file([B]msnt.exe,sdkcore.exe[/B])..but i can find nothing!!this is driving me nuts..n i cant clear the viruses from my com.they keep comin back!!n …

Hi all Plz help me i can't get rid of from hotoffers i tried everything but it still appears. Programs that i used - HiJackThis - Ad-Aware - Pocket Killbox - Spywarevansiher - Cleanmngr And some stupid question in one thread i have read says use Killbox and delete the …

Dear Moderator, I am relatively new to the world of adware, malware and other such inventions consisting of malicious/annoying code, and it is a great relief for me to discover, that there does exist, those few individuals who are dedicated to both fighting it and assisting others to protect themselves …

Hi, When I try to launch Internet Explorer, the hourglass cursor displays for a couple seconds, then reverts to the regular cursor. IE does not start and does not appear in the process list. My laptop is running XP. I suspect, (after reading many other posts) that the culprit is …

[B]about:blank![/B] Hi there i have a really bad problem with about:blank i have tryed all kinds of programs to remove this but nithing has worked it just come straight back again? here is my log from hijackthis! Any ideas anyone? Thanks in advance for any help! Logfile of HijackThis v1.99.1 …

[COLOR=Red][B]I have recently acquired the about:blank virus. I have looked at many forums online but nothing as resolved my problem. I get the imfamous blue background stating the problem (Trojan-Spy.html.smit.fraud.c). I also can not get rid of PSGuard (red and white circle in system tray. My homepage will not return …

While trying to delete, rename, move, or copy and paste a file I get the message: Cannot delete file: Cannot read from the source file or disk. While trying to use a program called Mboot (which can move or delete, move, etc files that don't start up when booting, I …

Logfile of HijackThis v1.99.1 Scan saved at 5:03:08 AM, on 7/11/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wdfmgr.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\System32\xl.exe C:\WINDOWS\system32\mseq.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Microsoft …

Ok. Brief summary of my problem. It first started when I noticed a PartyPoker icon on my desktop, and yazifind pop ups started to occur. I've been hijacked before and cleaned up fairly well (or did I?) so I knew some of the steps to take to get rid of …

I know I definitely have the Aurora junk and I am sure there are others. Here is my HiJackThis log. Thank you in advance: Logfile of HijackThis v1.99.1 Scan saved at 5:54:10 PM, on 7/13/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe …

Can't get rid of Communticator.dll (it keeps refreshing the C:\Program Files\COMMUNICATOR Toolbar (file) ) Ne help heres my Hijack this Log -------------------------------------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 1:04:44 PM, on 7/3/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe …

Hello all. I have a unknown icon flashing on and off in the taskbar whenever i open a new folder. The icon flashes on and off very fast. I managed to stop it by right-clicking on it however i have no idea what it is or how to get rid …

media player will not work on any type of file extention. have uninstalled and installed a newer version and i still get the same error "1099". also real player will not work either.

Okay, i'm getting very frustrated with the following problem. My Norton IS 2005 keeps getting me this popup with a high risk warning about a hacktool.rootkit virus. It supposed to be msdirectx.sys I tried a lot of cleaners, spyware removers etc. but it still doesnt work. Your help would be …

I just got done running hijackthis and got the log file but I am not sure on what I am supposed to get rid of. Any help would be greatly appreciated, thanks Ben here is the log file Logfile of HijackThis v1.99.1 Scan saved at 9:48:20 AM, on 7/13/2005 Platform: …

Logfile of HijackThis v1.99.1 Scan saved at 7:14:06 PM, on 7/8/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.exe c:\windows\system32\caemus.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Sony\HotKey Utility\HKserv.exe C:\Program Files\Common Files\CMEII\CMESys.exe C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe …

I tried following some steps posted at [url]www.pcreview.co.uk/forums/thread-1698461.php[/url] but i just cant delete these things. im new here and any help would be greatly appreciated. here is my hijackthis log file: Logfile of HijackThis v1.99.1 Scan saved at 5:00:01 PM, on 7/12/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet …

Zone alarm has detected 1362 intrusions since 2-2-04. Is that a false figure so that I'll buy the program(I'm using free trial version). Or am I so popular ;) on the internet?

Hi, I have taken some of the initial steps to remove this hacktool.rootkit infection on my machine. I have posted below the log from the run of hijackthis. While I did reboot and did not have IE open just before running hijackthis, I did have NAV running and wanted to …

I´m having the same problem, in both IE and Firefox. Here is the HJ log: Logfile of HijackThis v1.99.1 Scan saved at 05:11:49 p.m., on 11/07/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Archivos de programa\Archivos comunes\Symantec …

ok have 2 at the same time and cant get rid of them About:blank ans spysheriff. can you help??before I destroy my computer?I did some stuff before I found your site. nothing helped. Logfile of HijackThis v1.99.1 Scan saved at 5:11:39 PM, on 7/4/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) …

My buddy wasn't able to download all these nifty progs so I had to upload it to him through AIM. He's no longer having problems staying in a web browser so I had him run HJT and send me his log file. Here's part of it. O4 - HKLM\..\Run: [jf4] …

I am a new member and I need help removing the proper items of my hijack save log. can anyone help me? I dont know what spyware has infected my computer, I keep deleting the search explorer spyware with msn, but it keeps coming back whenever i reboot. :( Logfile …

hi there... i have read the other users how they cleared the virus.... do help me out here is the log... Logfile of HijackThis v1.99.1 Scan saved at 3:56:53 PM, on 7/8/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe …

Please help. Using the info in these forums and my own diligence I have gone from 2 trojans, various viruses and spyware/malware to only one problem left. I currently have spybot, adaware and spyware doctor showing up as clean, and yet, this small problem persists. I have run Spybot RegSupreme …

Not been here for ages the site looks a lot better. Right then. My computer keeps resetting itself when playing games and then once it has reset itself refuses to let me turn on the computer without doing so again untill i leave it turned off at least ten minutes. …

Hey everyone, this forum helped alot before so unfortunantely i am back again with more pop ups. Here is my hijack this log: Logfile of HijackThis v1.99.1 Scan saved at 11:51:29 AM, on 6/28/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe …

I've picked up a browser hijack and an extra toolbar that won't uninstall. Every time I reboot, Ad-Aware catches 30 or so baddies. I'm running a MacAfee firewall and virus protection, and use Ad-Aware and SpyBot on a fairly regular basis. Here's a log from after a reboot and an …

Dear All: I also have been infected with DrMon.dll and have downloaded and installed Hijackthis. Here is my printout from Hijackthis: Logfile of HijackThis v1.99.1 Scan saved at 10:49:26 PM, on 7/6/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\csrss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe …

Hello I recently was on my computer and i was websurfing. I xed out my web browser window and turned opened a new one. SUddenly i realized all my saved settings were gone. I DOnt know what happened. The web browser I use is mozilla firefox. Here is my hijackthis …

I dont know how can I uninstal my home-page (about:blanck) and a few pages from Favourites...FOREVER If you will hijackthis log or what send reply than I post it. THANKS

It would appear that I've got Aurora and Trojan Horse Downloader.Small.15.BS; here's my Hijackthis log Logfile of HijackThis v1.99.1 Scan saved at 2:26:58 AM, on 7/7/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe …

Hey; When i click on favorites in my explorer it shuts down the browser. I know someone else made a post of this and was told to use 'hijackthis' and post the results so here is what came up when i did my scan. Logfile of HijackThis v1.99.1 Scan saved …

Please help! Aurora pop-ups continue to appear even though I've run through Norton's trojan horse removal procedure several times. I was reading other entries in this forum and was going to attempt a fix prescribed to others members, but because they were customized recommendations based on their personal computer's "health" …

Hi My computer is infected with some sort of Adware/Spyware/Virus that adds links to certain words, which if you click on them expecting them to be a legitimate link it send you to [url]www.server4.103092804.com[/url] with adverts. Does anyone know how to get rid of this? I have Norton Anti Virus …

Eh, attempted to fix another comp heavily infested with a worm. Ran McAfee AV. It cleaned some files, I quaranteed others, and deleted the rest. It told me to reboot so I did. I ran every thing on the Rescue Disk and it found nothing. After I choose a user …

I have this dll in my windows\system32 directory. I can't find it on the net using any of the major search engines. It has been reported as being infected with a virus by Microworld AntiVirus & Spyware Toolkit Utility from [url]http://www.mwti.net/antivirus/mwav.asp[/url] No OTHER antivirus tool I have used says I …

Hi Everyone. This is my first time posting. I'd appreciate any help. Here's the problem: My teenage son was using my computer. I have Norton Anti Virus and alert windows started popping up about "high risk" and programs attempting to connect to DSN server. Some of them are "wupdt.exe", "thnall1a.exe", …

How do i get rid of them? Thanks in advance. more thanks to come. David part 1 of 2 of file Logfile of HijackThis v1.97.7 Scan saved at 2:42:53 PM, on 7/9/2005 Platform: Unknown Windows (WinNT 5.02.3790 SP1, v.1023) MSIE: Internet Explorer v6.00 (6.00.3790.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe …

This is my hi-jack this log....Thanks for your help. Logfile of HijackThis v1.99.1 Scan saved at 20:24:42, on 04.07.2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Intel\Wireless\Bin\EvtEng.exe C:\Programme\Intel\Wireless\Bin\S24EvMon.exe C:\Programme\Gemeinsame Dateien\Symantec Shared\ccProxy.exe C:\WINDOWS\Explorer.EXE C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSetMgr.exe C:\Programme\Norton Internet …

Hi. A virus appeared on my computer a few days ago and I've not been able to get rid of it, yet. In fact, I think it's expanded and let in a lot of other viruses, dyfuca and elite toolbar among them. AVG, Adware and Spybot Search and Destroy all …