Information Security Forum

Hi, Can anyone help on a few problems that I've got... Got a program thats kinda morphing (?), noticed an odd file name in task manager (a random combination of 6 or so letters) and saw that the details were all: TODO: <Product Name> in the directory c:\windows\system32 I end …

This comp has alot of issues now. For one, whenever i press any key on my keyboard, the entire CPU slows down. Then these aurora popups appear and my router screws up. PLEASE HELP!!! Here is my Hijack This log Logfile of HijackThis v1.99.1 Scan saved at 9:37:09 PM, on …

im having probley with my computer. i can play normally and then suddenly the computer will just freeze up and i can't do nothing but restart the computer. this is pissing me off heaps. here is my hijack log Logfile of HijackThis v1.99.1 Scan saved at 4:39:41 p.m., on 29/04/2005 …

hey I just saw a post with the same problem and the anwser to that fixed mine as well so thanks! so, sorry for the wasted post :cheesy:

Hello all and welcome me to forums, One of my client users has received the (apparently) very popular and useful Home Search Assistent and it's friends. Per suggestions in previous threads, I have tried both the HSRemove (2x reboot, 2x reboot) and the about: Buster (2x reboot, 2x reboot). Microsoft …

Please help - a colleague of mine noticed yesterday that e-mails were being generated from his machine to people in his address book with a dead link as the subject line: Microsoft Outlook Web Access: [url]http://DA-REALM-WMA01/Exchange/wmyers/Inbox/%20%20%20%20%20vv%20%20%20.%20%20%20%20bv.EML?cmd=open[/url] The subject line of the e-mail is vv . bv The colleague has received …

On the Processess of Task Manager there is this thing running: rnappp6.exe and it's eating up the CPU. Does anyone know what that is, i tried to Google it, but didn't come up with anything? thanks in advance..!!

I NEED HELP I'M HAVING PROBLEMS! Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\WINDOWS\Explorer.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Norton Personal Firewall\ISSVC.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton SystemWorks\Norton …

hi i have these 3 programs installed into my system which are causing my AIM to crash. I've tried removing them from Add & Remove Programs but none of them can be removed. Here is my log file from HiJackThis. please help. Logfile of HijackThis v1.99.1 Scan saved at 10:12:30 …

I cannot get rid of [url]http://rl.webtracer.cc/-/?bayzm[/url] as my homepage whatever I try, I am not sure what to do to get rid. Please help, my log is Scan saved at 15:59:49, on 09/05/2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe …

Hello everyone i am running a pc with win2k i am on cable broadband and on a home network all the other pc's in the house are fine til mine goes mad with the pc booted up and not running any internet software my pc (at no given time sometimes …

Hey Guys- I'm having severe troubles with this virus. I've tried so many different things and followed directions on many previous post and can't get rid of it. Here are some symptoms: -Start Bar There is a red circle with a white "X" that will send pop-ups every couple minutes …

How can I get rid of this...and what is it? [COLOR=Red]Exploit-MhtRedir.gen[/COLOR]

Within the past week or so, Norton has been prompting me that my virus definitions are out of date and that i must renew my subscription in order for my computer to be protected. I dont know how this could be since i purchased Norton only about 2 months ago. …

Crunchie, or anyone else who can help, Further to my earlier post, here is a copy of my scanlog from HJT. I am pretty sure that my machine is totally filled with s**t and I would like to remove as much of it as possible, but mainly this hotoffers lark. …

Hello! Does anybody know what does "generic host process for win32 services" mean? It keeps appearing in my computer when I have to restart.... Thanks!

Hello, For the past week or so I've been having issues with the pc ranging from what appear to be operating system issues (errors such as windows cannot find *.dll file) to issues with Microsoft Word (unable to autosave, losing data). Then mid week it appeared that some sort of …

Hi, I'm new here so please forgive me if I am posting in the wrong place. I have been having problems for the last two weeks and have tried everything I can think of but have got nowhere. Basically about 2 weeks ago IE6 started acting up it would not …

Hi, sorry i havent checked my orginal post from a while back but im having issues with this " dumprep 0 -u " again,, last time i think Kruchie helped me out by suggesting to check it off in the " misconfig" start up...but now theres a second running in …

I seem to be yet another vitim of hotoffers hijack spyware. ie, internet explored home page hijack, smuty desktop icons, virus warnings. All pointing to the same website: globolook. I've done a hijackthis scan and here are the results... Logfile of HijackThis v1.99.1 Scan saved at 09:19:46, on 25/04/2005 Platform: …

Probably like many others, I was recently infected with the Hotoffers hijack. I ran the uninstaller and deleted the *.dll's related to the problem, but a problem still lingers; that being that I still cannot access sites such as google.com, yahoo.com, msn.com, etc. On top of that, when I type …

Please help me!! My PC is going crazy.Norton is going crazy picking up viruses.There is a red circle with a white cross in it.Please advise me how to get rid of it.here is my HJT log file: Logfile of HijackThis v1.99.1 Scan saved at 7:59:08 PM, on 5/6/05 Platform: Windows …

I was at my brother's last night and his pc was getting an error message when booting or logging into. I did not take full note of the error, but it read: Atlcu32.exe something to the effect of .... %filename%.dll in the C:\windows\system 32 is not valid ... uhm,.. I'm …

Morning guys, I am having problems with my desktop. Have run adaware, spybot etc and says its all clean, but there is definately something not right. I have copied the hikackthis log and posted below and was wonderinf if anyone might be able to help... thanks in advance Hoggy Logfile …

I have picked up several spyware programs which adaware can't get rid of; one of them seems to be IST. Here is my hjt log file, can anyone help me? Logfile of HijackThis v1.99.1 Scan saved at 9:21:40 PM, on 5/3/2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 …

Simple as this, I can't get rid of them..... CAN SOMEBODY HELP ME ??????? L2MFIX find log 1.03 These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] ********************************************************************************** Shell Extension key: Windows Registry …

hi! any help given is much much appreciated. i really need to get some work done and my pc is running extremely slow. i've run panda scan, trendmicro, adaware, spybot, stinger, cwshredder, avg!!! here is my hijack this log: thanks in advance!! twoc Logfile of HijackThis v1.99.1 Scan saved at …

after trying everything from adaware to hijackthis i still can not remove hotoffers from taking over my home page....please help! here is my HJT log Logfile of HijackThis v1.99.1 Scan saved at 9:58:26 AM, on 5/5/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: …

Hi, Hot offers has changed my Internet Explorer home page. Have tried running No AdAware, Adware Away,Search and Destroy, When I run Spybot it says congratulations no immediate threats were found, Spyware Doctor identifies the "Hot Offers" problem but cannot fix it completely, it always says that one file cannot …

ive been having the biggest problem with this aurora popup, ive used ecery spyware and adware program i can think of and nothing can get rid of this thing, i have my latest hjt log so ill see what you guys can come up with Logfile of HijackThis v1.99.1 Scan …

hi there I am new to this forum/site. My computer has seemingly been infected by some type of hijacking software. Popups spring up constantly redirecting by Internet Explorer browser to about:blank and webforuser.com. Is there anyone who can help me clean this up? Here is the HIJack This log: Logfile …

I pasted all of the highjackthis report but Idont know if you can read it. I cant get my internet Explorer to download a single thing. I gat a message that IE cant find the file or the file doent exist. If someone could make heads or tails 0f this …

Hello, any help with the HijackThis log below would be greatly appreciated. This is a Win 2000 machine exhibiting the symptom of wallpaper replaced with white and message "IE Explorer error in VXD..." and warning of the smitfraud.c trojan. Also some tabs on display properties missing. Many thanks - Paul …

Please help. Whenever I open IE, the windows seem to replicate on my taskbar and I can't close it! There are two types of windows...one says OOO-Microsoft Internet Explorer - which doesn't do anything except stay there and 'replicate' - I can not close this. When I do, it just …

Hey everyone, Came home today and these two monsters were on my machine. I ran highjack this and would greatly appreciate some help. Logfile of HijackThis v1.99.1 Scan saved at 8:42:11 PM, on 5/3/2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\System32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe …

There are two suspicious dll files for which I would like an explanation -- LogonDll.dll (Winlogon notify) & streamhlp.dll (this one I have no clue). Having queried Google, I came up empty. These two don't look legitimate, & I have no idea where they slid in. My hijackthis log follows: …

Hi, Followed instructions and here is the new log. Thanks Logfile of HijackThis v1.99.1 Scan saved at 16:58:23, on 04/05/2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Norton …

Hello everyone On start up I keep getting this pop up that says run.exe is trying to access the internet and spybot has also found backweb lite on my comp. Here is my hijack log could someone please look at this and see if they can help. Thanks for your …

I am new here but ive managed to solve a lot of this 317 problem ! but there is still one thing and i think u can help :P ! i am running my PC in safe mode ! which is the only way to " use " it ! …

hi, im new here and i recently got a backdoor virus from AOL instant messenger that i could not delete also, when i started windows it said windows cannot find C:\WINDOWS\svchost.exe and i do not know what this means. more and more viruses keep popping up from the norton virus …

I am very sure (and hopeful) that someone here will be able to offer the solution. I have been reading posts here on the site for something very similar... i need some specific advice for my situation though please. I had the same situation where pop-ups keep arising saying that …

hi,im new here.and my computer is beeing taken over by this hotoffers stuff.i only have spybot:S&D and dont know what to do next.i am a total idiot because dont have a clue how to remove this stuff.so, please help me before i become more crazy.PLEASE

I have the exact same problem >> ---------------------------- 04-28-2005, 02:05 PM Mishoboy Junior Poster Join Date: Apr 2005 Posts: 8 Help Porn Pop-Ups, Error #317 and a red circle icon with white X in Tray -------------------------------------------------------------------------------- Let me cut to the chase. I have a friend who recently got infected …

Can't get rid of aurora popup, tried everything i know. I downloaded HJT and this is what I got, any help would be appreciated! Logfile of HijackThis v1.99.1 Scan saved at 8:23:36 AM, on 5/2/2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe …

Please help me. I have perused through other threads on this virus and cannot seem to get rid of my problem. I have started to delete only some of the items. In regular or safe mode I am unable to delete param32.dll I will attach my log from HiJackThis. I …

Hey, I've looked through this forum and haven't found any thread about my situation, so i decided to post a new one. One day last week I opened up Internet explorer, and wanted to goto one of my favorite links. When I clicked on favorites though, instead of having my …

While on some health site, a bunch of warnings kept poping in, and I had Nod32 and counterspy installed....i thought everything would be o.k. Anyway, here is the problem....... My opening page has all the icons except the screen is blue and in the middle there is a Security Warning …

Logfile of HijackThis v1.99.1 Scan saved at 9:33:16 AM, on 5/1/2005 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v5.50 (5.50.4134.0100) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\SYSTEM\WINUPDT.EXE C:\WINDOWS\SYSTEM\APHMVM.EXE C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch …

I've been looking through some old posts on this topic, which I do need help on. Most all of them say I ought to run some spyware programs, then HJT, and post a log. So, this is my log after running Ad-Aware personal SE, and SpySubtract. CWShredder catches nothing in …

Logfile of HijackThis v1.99.1 Scan saved at 19:00:10, on 28/04/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe C:\Program Files\BT …