February 22, 200620 yr I downloaded a patch which i thought was a mod to a game, i scanned it before opening it and it came up ok (with AVG). Then i open it and i get about 4 popups from my firewall saying this Application Hijacking has been detected The application: C:\Documents and Settings\paul wilson\Local Settings\Temp\ddl5.tmp[Caution: ExecutableFile] try to launch another application: C:\Program Files\Internet Explorer\iexplore[Caution: ExecutableFile] to go to remote host impotato.com Then an error message with the title in the bar at the top called "dialler" came up with something spanish writen on it. I tried to delete it but it was running, so i tried to boot in safemode and that didn't work, (rarly does for me, no idea why), so i tried the other safemode options (with command promts and with network settings) and the same happened. When i tried to boot normally it came up wih a blue screen of death which said dumping physical memory. I restarted again and it was on a scan thingy with the light blue background. It recoverd two files at 320,000kb (roughly) whick i think where spoolv[Caution: ExecutableFile] or something similar and another file. Any idea what the hell happened? First and only pixel thinger I made.
February 22, 200620 yr In a simple answer you basicly installed a virus. Do the usual stuff as stated in stickies and post a HJT log. Mercifull <3 Suzi "We don't want players to be able to buy their way to success in RuneScape. If we let players start doing this, it devalues RuneScape for others. We feel your status in real-life shouldn't affect your ability to be successful in RuneScape" Jagex 01/04/01 - 02/03/12
February 22, 200620 yr Author Logfile of HijackThis v1.99.1 Scan saved at 11:28:57 PM, on 02/22/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss[Caution: ExecutableFile] C:\WINDOWS\system32\csrss[Caution: ExecutableFile] C:\WINDOWS\system32\winlogon[Caution: ExecutableFile] C:\WINDOWS\system32\services[Caution: ExecutableFile] C:\WINDOWS\system32\lsass[Caution: ExecutableFile] C:\WINDOWS\system32\svchost[Caution: ExecutableFile] C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc[Caution: ExecutableFile] C:\WINDOWS\System32\svchost[Caution: ExecutableFile] C:\Program Files\Sygate\SPF\smc[Caution: ExecutableFile] C:\WINDOWS\System32\svchost[Caution: ExecutableFile] C:\WINDOWS\System32\svchost[Caution: ExecutableFile] C:\WINDOWS\system32\spoolsv[Caution: ExecutableFile] C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr[Caution: ExecutableFile] C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc[Caution: ExecutableFile] C:\WINDOWS\system32\cisvc[Caution: ExecutableFile] C:\Program Files\Diskeeper Corporation\Diskeeper\DkService[Caution: ExecutableFile] C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm[Caution: ExecutableFile] C:\WINDOWS\Explorer[Caution: ExecutableFile] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc[Caution: ExecutableFile] C:\Program Files\MessengerPlus! 3\MsgPlus[Caution: ExecutableFile] C:\Program Files\Java\jre1.5.0_06\bin\jusched[Caution: ExecutableFile] C:\Program Files\Labtec\Mouse\2.1\moffice[Caution: ExecutableFile] C:\Program Files\Labtec\Media Keyboard\V5.0\KbdAp32A[Caution: ExecutableFile] C:\Program Files\TuneUp Utilities 2006\MemOptimizer[Caution: ExecutableFile] C:\Program Files\Labtec\Mouse\2.1\MOUSE32A[Caution: ExecutableFile] C:\Program Files\MSN Messenger\msnmsgr[Caution: ExecutableFile] C:\WINDOWS\system32\cidaemon[Caution: ExecutableFile] C:\Program Files\Mozilla Firefox\firefox[Caution: ExecutableFile] C:\Documents and Settings\paul wilson\Desktop\HijackThis[Caution: ExecutableFile] R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.iprimus.com.au/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = bugy peice'o'crap O1 - Hosts: 67.15.36.57 iris.phoenixrising.ws O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [smcService] C:\PROGRA~1\Sygate\SPF\smc[Caution: ExecutableFile] -startgui O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc[Caution: ExecutableFile] /STARTUP O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus[Caution: ExecutableFile]" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask[Caution: ExecutableFile]" -atboottime O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify[Caution: ExecutableFile] O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched[Caution: ExecutableFile] O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] C:\Program Files\Labtec\Mouse\2.1\moffice[Caution: ExecutableFile] O4 - HKLM\..\Run: [LWBKEYBOARD] C:\Program Files\Labtec\Media Keyboard\V5.0\KbdAp32A[Caution: ExecutableFile] O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon[Caution: ExecutableFile]" O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus[Caution: ExecutableFile]" /WinStart O4 - HKCU\..\Run: [TuneUp MemOptimizer] "C:\Program Files\TuneUp Utilities 2006\MemOptimizer[Caution: ExecutableFile]" autostart O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs[Caution: ExecutableFile]" /background O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr[Caution: ExecutableFile]" /background O4 - Global Startup: LG SyncManager.lnk = C:\Program Files\LG PC Suite\LG PC Sync\LGSyncManager[Caution: ExecutableFile] O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker[Caution: ExecutableFile] (file missing) O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker[Caution: ExecutableFile] (file missing) O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} - O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} - O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1128064661187 O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - O16 - DPF: {B9F3009B-976B-41C4-A992-229DCCF3367C} - O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O18 - Protocol: talkto - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr[Caution: ExecutableFile] O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc[Caution: ExecutableFile] O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService[Caution: ExecutableFile] O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc[Caution: ExecutableFile] O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc[Caution: ExecutableFile] Theres the log First and only pixel thinger I made.
February 22, 200620 yr Why are you still running XP Service pack 1 >.< http://www.windowsupdate.com immediatly Remove this O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) Take off these two if you dont want the PartyPoker icon in the IE toolbar O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker[Caution: ExecutableFile] (file missing) O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker[Caution: ExecutableFile] (file missing) Theres some other things too but i dont have time to properly investigate them. Leave it to a tech head, thats what they are supposed to do Mercifull <3 Suzi "We don't want players to be able to buy their way to success in RuneScape. If we let players start doing this, it devalues RuneScape for others. We feel your status in real-life shouldn't affect your ability to be successful in RuneScape" Jagex 01/04/01 - 02/03/12
February 23, 200620 yr first backup everything incase i give you bad advice MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) your ie needs updating C:\Program Files\Labtec\Mouse\2.1\moffice[Caution: ExecutableFile] Check with an antivirus scanner unkown process seems tyo be your mouse extra software (if it is leave it alone) C:\Program Files\TuneUp Utilities 2006\MemOptimizer[Caution: ExecutableFile] says it should be in c:\programme\tuneup utilities\ if you installed it there your ok C:\Program Files\Labtec\Mouse\2.1\MOUSE32A[Caution: ExecutableFile] says it usually runs in c:\programme\browser mouse if you installed it here your ok O1 - Hosts: 67.15.36.57 iris.phoenixrising.ws this is in your hosts. file if you put this there then its ok.. if not i would recomend backing it up and removing it O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) supposedly google toolbar? if oyu have that installed uninstall and re-run if it dissappears your ok.. if not remove it O4 - Global Startup: LG SyncManager.lnk = C:\Program Files\LG PC Suite\LG PC Sync\LGSyncManager[Caution: ExecutableFile] says its a manager for a LG phone? do you rememebr installing this? if not remove O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker[Caution: ExecutableFile] (file missing) O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker[Caution: ExecutableFile] (file missing) remove since they don't refenace anything valid O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} - O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - shoudl be removed as they look nasty O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} - O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - O16 - DPF: {B9F3009B-976B-41C4-A992-229DCCF3367C} - remove but keep backups just in case i would also upgrade to sp2 and make sure oyu have a backup of the changed hijack this will make The following statement is true. The previous statement is false. 60% of all statistics are made up 90% of the time andrew i love you & want you to have my babys!!! Finally, I get to save the Earth with deadly lasers instead of deadly slide shows!
February 23, 200620 yr @Mementh: Use the English version of hijackthis.de and you wont get 'this file is in the wrong place' messages (see the TuneUp line) ;)
February 23, 200620 yr @Mementh: Use the English version of hijackthis.de and you wont get 'this file is in the wrong place' messages (see the TuneUp line) ;) thanks The following statement is true. The previous statement is false. 60% of all statistics are made up 90% of the time andrew i love you & want you to have my babys!!! Finally, I get to save the Earth with deadly lasers instead of deadly slide shows!
Create an account or sign in to comment