View Today's Active Threads (No Chit Chat/Chit Chat Only) / View New Posts (No Chit Chat/Chit Chat Only) / Mark All Boards Read / Chit Chat Board
Chit Chat - Main Board / Games / Movies / Music / Sports / Video Games / Chit Chat - Classic / View Latest Threads in All Chit Chat Boards
|
|
|||||||
 |
|
|
Thread Tools | Search this Thread |
04-14-2006, 12:27 PM
|
#1 |
|
MAN VS SAMMICH.
Forum Star
Join Date: Mar 23, 2005
Location: Louisiana
Posts: 16,413
|
ok robyrob...
the dumb compy won't let me get on my accout at the startup menu but here is a log file from my dads
Logfile of HijackThis v1.99.1 Scan saved at 11:26:20 AM, on 4/14/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe c:\program files\mcafee.com\agent\mcdetect.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe c:\PROGRA~1\mcafee.com\agent\mctskshd.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\wanmpsvc.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\McAfee.com\VSO\mcvsshld.exe C:\Program Files\McAfee.com\VSO\oasclnt.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\MUSICMATCH\Musicmatch Jukebox\MMDiag.exe c:\progra~1\mcafee.com\vso\mcvsftsn.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Earl Heppe\Local Settings\Temporary Internet Files\Content.IE5\IR8JQ9C3\HijackThis[1].exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway F2 - REG:system.ini: UserInit=userinit.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file) O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: (no name) - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - (no file) O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O3 - Toolbar: (no name) - {82315A18-6CFB-44a7-BDFD-90E36537C252} - (no file) O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe" O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [MMTrayLSI] MMTrayLSI.exe O4 - HKLM\..\Run: [MMTray2K] MMTray2k.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray O4 - HKLM\..\Run: [masqform.exe] C:\Program Files\PureEdge\Viewer 6.5\masqform.exe -RunOnce O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [Device Detector] DevDetect.exe -autorun O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing) O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://tv.disney.go.com/global/downl.../OTOYAX29b.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab O16 - DPF: {C02226EB-A5D7-4B1F-BD7E-635E46C2288D} (Toontown Installer ActiveX Control) - http://a.download.toontown.com/sv1.0.18.39/ttinst.cab O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/.../Installer.exe O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: axdebugl - C:\WINDOWS\SYSTEM32\axdebugl.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe what can i do to get back on my account? 
|
|
__________________
Whether I'm the rose of sheer perfection
A freckle on the nose of life's complexion The Cinderella or the shine apple of its eye I gotta fly once, I gotta try once, Only can die once, right, sir? Ooh, life is juicy, juicy and you see, I gotta have my bite, sir. Get ready for me love, 'cause I'm a "comer" I simply gotta march, my heart's a drummer Don't bring around the cloud to rain on my parade |
|
|
|
|
04-14-2006, 02:30 PM
|
#2 |
|
certified wackball#3
Moderator
Forum Icon 
Join Date: Aug 03, 2003
Location: hiding under the third booth at Arnold's
Posts: 58,230
|
looks like there is a possible Rootkit/Trojan on there - by the presence of axdebugl.dll, check out this page: http://www.avira.com/en/threats/sect....ct.1.e.3.html
I'll have to see if I can find a removal tool later, but for now you could try: - in HijackThis "fix" all of the BHO: (no name) items and anything with the axdebugl.dll, open the Misc Tools section, go to delete a file on reboot and put in the "C:\WINDOWS\SYSTEM32\axdebugl.dll" - run CCleaner , then the ewido Security Suite (free trial version) this thing goes by different Aliases: • Kaspersky: Trojan-Spy.Win32.Goldun.iw • VirusBuster: Rootkit.Agent.10 • Bitdefender: Trojan.Spy.Goldun.IW |
|
__________________
* GeeksToGo * AntiVir * Avast antivirus * Housecall Online * Sysinternals Security Utilities * * ZoneAlarm * Agnitum-firewall * Comodo Firewall * AVG Anti-Rootkit * RootkitRevealer * ParasiteCheck * * Annoyances * FreeCodecs * Mikes-Hosts-File * GRC.com * MSAntispyware * DVD's * TradeList * myspace * |
|
|
|
|
|
04-14-2006, 02:31 PM
|
#3 |
|
certified wackball#3
Moderator
Forum Icon
Join Date: Aug 03, 2003
Location: hiding under the third booth at Arnold's
Posts: 58,230
|
...as for getting back into your account, can you create a new account, or change the password to your account from your dad's account?
(Start>Control Panel>User Accounts) |
|
|
|
|
04-14-2006, 06:31 PM
|
#4 | |
|
MAN VS SAMMICH.
Forum Star
Join Date: Mar 23, 2005
Location: Louisiana
Posts: 16,413
|
Quote:
I'm deleting my old one and making a new one. heh. |
|
|
|
|
|
04-14-2006, 06:37 PM
|
#5 |
|
MAN VS SAMMICH.
Forum Star
Join Date: Mar 23, 2005
Location: Louisiana
Posts: 16,413
|
gah it's locking up >.<
|
|
|
|
|
04-14-2006, 08:47 PM
|
#6 |
|
MAN VS SAMMICH.
Forum Star
Join Date: Mar 23, 2005
Location: Louisiana
Posts: 16,413
|
weee I have a new account but i lost EVERYTHING gah.
oh well and it's super slow |
|
|
|
|
04-15-2006, 11:40 PM
|
#7 |
|
MAN VS SAMMICH.
Forum Star
Join Date: Mar 23, 2005
Location: Louisiana
Posts: 16,413
|
GAH IT'S NOT LETTING ME IN MY NEW ACCOUNT!!!11111
*IS LIVID PISSED* what do i do? I've removed my password and it won't let me in it!!!! gah! I'm so fustrated! |
|
|
|
|
04-16-2006, 10:43 AM
|
#8 |
|
certified wackball#3
Moderator
Forum Icon
Join Date: Aug 03, 2003
Location: hiding under the third booth at Arnold's
Posts: 58,230
|
you might want to get your dad to help you with this one ashlee - it is a Trojan and a Rootkit, designed to take over your machine, steal passwords and banking information, if he has important stuff on there he should probably know about this.
here is the Norton/Symantec page on this: http://www.symantec.com/avcenter/ven....goldun.i.html there are instructions on that page to remove it, most CURRENT antivirus programs should be able to remove the Trojan if they are up-to-date and you follow the specific removal instructions. |
|
|
|
|
|
|
