Posts by hamada_1990

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 23:45, on 2007-07-18
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\PROGRA~1\MYWEBS~1\bar\4.bin\m3SrchMn.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\portableapps\PortableApps\FirefoxPortable\App\firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\System32\msiexec.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Microsoft Windows OneCare Live\OCSetup.exe
C:\Documents and Settings\Owner\My Documents\Downloads\Programs\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-gb7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-gb7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Farstone Url Blocker - {316AEF8D-3C37-423E-9E6E-13820A9DC37A} - C:\PROGRA~1\PCSECU~1\THESHI~1\IrlOnIE.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: …

ok

did that not working

it opens then closes real fast i can't even see hat it writes ??

ha ha i see

and no virus scanner

office xp windows xp sp2 homedition

and yes

i got 1gb ram 532204 free memory

ok so i need to do something as if i was going to format it but instead i just repair it??

people i am having the weirdest case ever the computer that i am using currently when i open a document word or excel or any sort of ms office it seems to crash down after the product splash screen??!!!:S

nope not yet

but i ain't looking for realistic games i am looking for fun games anyone who thinks nfs cabon is stupid say yes let me be the first to sayy

NO IT AIN'T

but in the link you gave me i couldn't find from where to download or i have to go and buy it??

oh man
u r rite i forgot about grand turismu the best game and hardest driving game i ever played in ma life toca rica driver i never heard of it??

subway -> restaurant

-8

i never had such a problem with orange or o2 cause i am a top up sim haha

no that came wrong i meant ever broke your leg in an accident?

Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes Itunes 4eveeeeeeeeeeeeeeeeerrrrrrrrr

when i am not infront pc i am

sleeping sleeping, drag racing,drifting ,flirting girls in clubs and most of the time in jail usually get busted in drag racings but never in drifting ha ha #
take that police no body catches me if you are following me in dirt hahaha

ha ha ha i drive a car since i was 12 but again i was a rebelion kid since i was 9 hahaha and now i am 17 with no driving license and i own 2 cars haha

i'll tell what to do cause i never trusted this recovery crap i once had a problem but all i did was inserting the windows xp and booted in the blue screen of booting press R for repair thats what i did and it worked but however this may not wor for you cause you got the recovery i never had the recovery thing and I'll never trust it

is that good and look at my task manager after combofix is it good normal or bad???

people i am a very cautious man so i did the vundu and the combo and here is the combo report

"Owner" - 2007-07-18 21:58:47 - ComboFix 07-07-14.6 - Service Pack 2  NTFS  

[i] ADS removed - svchost.exe: deleted 36 bytes in 1 streams. [/i]

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\Owner\APPLIC~1.\macromedia\Flash Player\#SharedObjects\YE8YZJEZ\[url]www.broadcaster.com[/url]
C:\DOCUME~1\Owner\APPLIC~1.\macromedia\Flash Player\#SharedObjects\YE8YZJEZ\[url]www.broadcaster.com\played_list.sol[/url]
C:\DOCUME~1\Owner\APPLIC~1.\macromedia\Flash Player\#SharedObjects\YE8YZJEZ\[url]www.broadcaster.com\video_queue.sol[/url]
C:\DOCUME~1\Owner\APPLIC~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#[url]www.broadcaster.com[/url]
C:\DOCUME~1\Owner\APPLIC~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#[url]www.broadcaster.com\settings.sol[/url]
C:\UGA6P
C:\WINDOWS\b.exe
C:\WINDOWS\system32\afiborhd.exe
C:\WINDOWS\system32\aftjwhks.exe
C:\WINDOWS\system32\cqnomxtp.exe
C:\WINDOWS\system32\dpiyysno.exe
C:\WINDOWS\system32\fgtyjary.exe
C:\WINDOWS\system32\fpmwldgn.exe
C:\WINDOWS\system32\fqqlaera.exe
C:\WINDOWS\system32\habfxevr.exe
C:\WINDOWS\system32\ioirfbyy.exe
C:\WINDOWS\system32\jhnoyeqd.exe
C:\WINDOWS\system32\jrqusrdq.exe
C:\WINDOWS\system32\juqkwlqn.exe
C:\WINDOWS\system32\kxgkbgsw.exe
C:\WINDOWS\system32\lausopeu.exe
C:\WINDOWS\system32\lyqmtoew.exe
C:\WINDOWS\system32\mtbhmuyx.exe
C:\WINDOWS\system32\nucxyjyo.exe
C:\WINDOWS\system32\nvs2.inf
C:\WINDOWS\system32\qbecivfi.exe
C:\WINDOWS\system32\qltjgbvn.exe
C:\WINDOWS\system32\rgglxvxl.exe
C:\WINDOWS\system32\rhhallyg.exe
C:\WINDOWS\system32\sorboqoo.exe
C:\WINDOWS\system32\toqyxupl.exe
C:\WINDOWS\system32\trprpvcp.exe
C:\WINDOWS\system32\tsofaohv.exe
C:\WINDOWS\system32\tvxymvdf.exe
C:\WINDOWS\system32\uryevdap.exe
C:\WINDOWS\system32\uxnenixc.exe
C:\WINDOWS\system32\vutelehy.exe
C:\WINDOWS\system32\wnxcuddw.exe
C:\WINDOWS\system32\wtlbpdvd.exe
C:\WINDOWS\system32\yaabbalt.exe
C:\WINDOWS\system32\yspxmthf.exe


(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_FOPF


(((((((((((((((((((((((((   Files Created from 2007-06-18 to 2007-07-18  )))))))))))))))))))))))))))))))


2007-07-18 21:57    51,200  --a------   C:\WINDOWS\nircmd.exe
2007-07-18 21:09    <DIR>    d--------   C:\VundoFix Backups
2007-07-18 14:17    <DIR>    d--------   C:\Program Files\Western Digital Technologies
2007-07-18 01:49    1,324   --a------   C:\WINDOWS\system32\d3d9caps.dat
2007-07-18 01:12    <DIR>    d--------   C:\svchost solution i hope !!1
2007-07-17 23:08    1,222,434   ---hs----   C:\WINDOWS\system32\fgjlm.ini2
2007-07-17 21:19    1,214,356   ---hs----   C:\WINDOWS\system32\fgjlm.bak2
2007-07-17 13:34    6,369   ---hs----   C:\WINDOWS\system32\fgjlm.bak1
2007-07-17 00:41    1,347,825   ---hs----   C:\WINDOWS\system32\bcbeg.ini2
2007-07-16 22:17    83,024  --a------   C:\WINDOWS\system32\drivers\iksyssec.sys
2007-07-16 22:17    57,424  --a------   C:\WINDOWS\system32\drivers\iksysflt.sys
2007-07-16 22:17    53,840  --a------   C:\WINDOWS\system32\drivers\ikfilesec.sys
2007-07-16 22:17    39,376  --a------   C:\WINDOWS\system32\drivers\ikfileflt.sys
2007-07-16 22:17    29,264  --a------   C:\WINDOWS\system32\drivers\kcom.sys
2007-07-16 22:16    <DIR>    d--------   C:\Program Files\Spyware Doctor
2007-07-16 22:16    <DIR>    d--------   C:\DOCUME~1\Owner\APPLIC~1\PC Tools
2007-07-14 19:17    3,968   --a------   C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-07-14 19:01    <DIR>    d--------   C:\DOCUME~1\Owner\APPLIC~1\Babylon
2007-07-13 17:48    <DIR>    d--------   C:\DOCUME~1\Owner\APPLIC~1\URSoft
2007-07-12 18:34    <DIR>    d--------   C:\DOCUME~1\Owner\APPLIC~1\IDM
2007-07-12 18:34    <DIR>    d--------   C:\DOCUME~1\Owner\APPLIC~1\DMCache
2007-07-12 18:33    <DIR>    d--------   C:\Program Files\Internet Download Manager
2007-07-11 18:18    <DIR>    d--------   C:\DOCUME~1\Owner\APPLIC~1\GTek
2007-07-11 01:23    91,672  --a------   C:\WINDOWS\system32\drivers\msfwdrv.sys
2007-07-11 01:23    116,632 --a------   C:\WINDOWS\system32\drivers\msfwhlpr.sys
2007-07-11 01:13    7,168   --------- …

well my pc is a bit better but not the way it used to be :( but thanx anyway here is a screen shot of my taskmanager

but i still got few problems

winlogon is 1.304 and peopl what is Mspeng????

is my tasks normal or good or bad??

well here is the log

VundoFix V6.5.6

Checking Java version...

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Scan started at 21:09:57 18/07/2007

Listing files found while scanning....

C:\windows\system32\beejhupt.dll
C:\windows\system32\bfqepbbp.ini
C:\windows\system32\bskbrbbo.dll
C:\windows\system32\bwxnflhf.dll
C:\windows\system32\bylnndwd.exe
C:\windows\system32\cdfkopuh.exe
C:\windows\system32\cifavgke.exe
C:\windows\system32\cljlsjmw.dll
C:\windows\system32\cmksktlt.exe
C:\windows\system32\dapgobvx.dll
C:\windows\system32\dbyuwpgr.exe
C:\windows\system32\dmawingd.exe
C:\windows\system32\dwwutmjt.exe
C:\windows\system32\empwijpn.dll
C:\windows\system32\endyolyq.dll
C:\windows\system32\eopacstr.exe
C:\windows\system32\equjnjnj.exe
C:\windows\system32\evlywdek.dll
C:\windows\system32\evmndeqk.dll
C:\windows\system32\ewjulxqv.dll
C:\windows\system32\fbiesvgb.dll
C:\windows\system32\fdaugihx.dll
C:\windows\system32\ffeadryq.dll
C:\windows\system32\fhlfnxwb.ini
C:\windows\system32\fjvgtwqi.ini
C:\windows\system32\fmajmwvg.exe
C:\windows\system32\fnpblqrn.dll
C:\windows\system32\fugyymow.dll
C:\windows\system32\fvmfxoin.dll
C:\windows\system32\ggqqrtko.ini
C:\windows\system32\gjorlqyd.exe
C:\WINDOWS\system32\gpjgjdgl.dll
C:\windows\system32\gpsuvehj.dll
C:\windows\system32\gqxvdcsk.ini
C:\windows\system32\gyremwhv.dll
C:\windows\system32\hayjyfyo.dll
C:\windows\system32\hyetxhgi.dll
C:\windows\system32\iewonddg.dll
C:\windows\system32\ighxteyh.ini
C:\windows\system32\ilrkdagh.dll
C:\windows\system32\ilsmpray.exe
C:\windows\system32\inbbgkpg.exe
C:\windows\system32\iomnpksb.dll
C:\windows\system32\iqwtgvjf.dll
C:\windows\system32\jhpbtbue.dll
C:\windows\system32\jmtypgtp.exe
C:\windows\system32\jucouhvq.exe
C:\windows\system32\jvlnjdyu.dll
C:\windows\system32\kcjxobff.dll
C:\windows\system32\kedwylve.ini
C:\windows\system32\kfkuhrtn.ini
C:\windows\system32\kfoibsrb.exe
C:\windows\system32\kploihva.exe
C:\windows\system32\kqnqppat.dll
C:\windows\system32\krolhbht.dll
C:\windows\system32\kscdvxqg.dll
C:\windows\system32\ljmgnmir.dll
C:\windows\system32\llfotqhv.dll
C:\windows\system32\lobvedxy.exe
C:\windows\system32\ltghehtq.dll
C:\windows\system32\mgtwhyqn.ini
C:\windows\system32\miawwclm.exe
C:\windows\system32\mihijink.exe
C:\windows\system32\mkhiioku.exe
C:\WINDOWS\system32\mljgf.dll
C:\windows\system32\nahxxvvi.dll
C:\windows\system32\ncoaofds.exe
C:\windows\system32\nijkqsra.exe
C:\windows\system32\nqyhwtgm.dll
C:\windows\system32\ntrhukfk.dll
C:\windows\system32\nxaysrbt.ini
C:\windows\system32\odqvjoda.dll
C:\windows\system32\oktrqqgg.dll
C:\windows\system32\omtajobx.exe
C:\windows\system32\onqwghdd.dll
C:\windows\system32\opntcsxe.dll
C:\windows\system32\pbbpeqfb.dll
C:\windows\system32\pdaguemm.dll
C:\windows\system32\pfarimie.exe
C:\windows\system32\pgcrreum.exe
C:\windows\system32\pnsjrldg.dll
C:\windows\system32\prfnxixr.exe
C:\windows\system32\qavyxffq.ini
C:\windows\system32\qffxyvaq.dll
C:\windows\system32\qjhwtnuu.exe
C:\windows\system32\qthehgtl.ini
C:\windows\system32\qyxoiali.dll
C:\windows\system32\rdykugbw.exe
C:\windows\system32\reloyeeo.exe
C:\windows\system32\rkmwkcbw.dll
C:\windows\system32\rnfmotdw.exe
C:\windows\system32\rppsadru.dll
C:\windows\system32\rtykfogi.exe
C:\windows\system32\rwwxdowi.exe
C:\windows\system32\sdqhkbbv.dll
C:\windows\system32\seecghbw.ini
C:\windows\system32\slbfkbud.exe
C:\windows\system32\snabmvts.exe
C:\WINDOWS\system32\ssqqrpo.dll
C:\windows\system32\tbrsyaxn.dll
C:\windows\system32\tlhvoxgc.dll
C:\windows\system32\tpcvuvpn.dll
C:\windows\system32\ujaatklm.exe
C:\windows\system32\urdasppr.ini

but now i am gonna go for gerbil cause his is easier then i'll check out ur way jbennet

no it wont. SFC (system file checker) compares the core windows filwes like winlogon and svchost against the ones on your windows cd (or ones it keeps hidden in a cache) and if they dont match (changed by spyware) then it replaces them with good ones

and yeah, spyware isnt my area.

thanx :)

people thanx alot now gtg i am in the process wish me luck :S

ok then mine is x86 and i don't need the emulator????

why are you sad then you want to destroy one of them why don't you send it to me :)

for the love of god help HELP what should i do next??

would you please look at my hijckthis report :|

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 14:45:08, on 18/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\WINDOWS\system32\kfoibsrb.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\PROGRA~1\MYWEBS~1\bar\4.bin\m3SrchMn.exe
C:\Program Files\Internet Explorer\iexplore.exe
H:\portableapps\PortableApps\PortableUTorrent\utorrent.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\svchost solution i hope !!1\HiJackThis_v2.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://gb7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-gb7.hpwis.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-gb7.hpwis.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} …

cool if u made me lose my money for some stupid book i will i will...........uf i will do nothing :\

wuill that make me lose my data???

:\ i got an idea GO BUY!!!!!

cause i said so :P

this my bro-in-law computer in england quite boring i adjusted it for him

http://www.m5zn.com/uploads/37063e1a5a.bmp

and i just opened the emulator but i don't want to run xp then run the emulator to run the mac os can't i just buy the freakin mac os cd and install it and work on it as if it is normal mac os or no

or do i have to download the emulator?? please answer

people stop argueing all i asked was can i run it o a normal pc or no thats it just answer yes but if there are requirements then tell me all i know is it runs on x86 but how can i know that my pc is x86??

yeah actually i never met a computer geek before

u c i told u there is something wrong in here :@

Er.. big Naruto fan here :P

such a shame having an ugly pc is it a normal vista or a vista theme for xp?

lol

imageshack.us]http://img149.imageshack.us/img149/6417/untitledpg3.jpg[/url]

dang!!

coooooooooooooooooooooooooool i admire your work my pc is in sudan currently i am in england stuck in a boring computer :( but i can tell u something you won't even know is it a MAC? OR VISTA? OR LINUX?OR IS IT SOMETHING ELSE it is exotic god i miss it :'(

haven't tried it

break someone leg?

ok thats it close this thread NOW!!!

it can't be my fluoro backlight i bought the damn screen like 1 month only and no it doesn't respond to my manipulation but problem solved it seems that its all cause of the svchost takes lots of memory and so fixed it

when is it???

never tried it

drag racing and drifting??

what is the book called??