Forum &gt; General discussions &gt; Non mobile discussion &gt; cycovision - pc help thread

Joined: Nov 30, 2003
Posts: > 500
From: England
PM, WWW

Posted: 2006-02-26 15:45

Ummm, very odd! I shan't bother looking at that thread then

Joined: Nov 24, 2004
Posts: > 500
From: Manchester (@ Uni)
PM

Posted: 2006-02-26 22:32

well seems to have stopped but

when i do ctrl alt delete

this is running in the applications bit like where msn, IE is or w/e i got open

rundll32

now has Proyecto1 instead :S

or summit like that

is that bad?

_________________
My Ebay Items (Check My ME page out)

[ This Message was edited by: max99 on 2006-02-26 21:36 ]

Joined: Nov 30, 2003
Posts: > 500
From: England
PM, WWW

Posted: 2006-02-27 10:56

proyecto1 is aded by the GRUEL worm, so you definately don't want it! Do a virus scan and if the AV software doesn't pick it out, we can use hijack this and good old fashioned file renaming to get rid of it instead.

Pictures in my head
What's your Problem?

axxxr

Joined: Mar 21, 2003
Posts: > 500
From: Londinium
PM, WWW

Posted: 2006-02-27 12:42

My PC has started to beep every 5 seconds....don't know what the problem is can anyone help? ....seems to be coming from the H/D. [addsig]

mince-inside

Joined: May 09, 2004
Posts: 452
From: Made in Alnwick living in Scot
PM

Posted: 2006-02-27 12:46

@Axxxr
Sounds like it could be temperature alarm - take the side of and make sure the fans are spinning (hope you've not got long hair). Or do you have a UPS? it may have lost it's feed

Mr M

axxxr

Joined: Mar 21, 2003
Posts: > 500
From: Londinium
PM, WWW

Posted: 2006-02-27 12:48

Ok i'll check it out thanks for that! [addsig]

Joined: Nov 24, 2004
Posts: > 500
From: Manchester (@ Uni)
PM

Posted: 2006-02-27 18:00

cant seem 2 download avg as soon as i google it , IE closes down lol

ill run hijack this now [addsig]

Joined: Nov 24, 2004
Posts: > 500
From: Manchester (@ Uni)
PM

Posted: 2006-02-27 18:03

Logfile of HijackThis v1.99.1
Scan saved at 17:01:01, on 27/02/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\WScript.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Program Files\blueyonder IST\bin\mpbtn.exe
C:\WINDOWS\system32\regsrv.exe
C:\WINDOWS\System32\devldr32.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Max Bramwell\My Documents\hijackthis\HijackThis.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\ntvdm.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 203.115.10.36:80
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F0 - system.ini: Shell=Explorer.exe C:\WINDOWS\system32\winmgd.win
F1 - win.ini: run=C:\WINDOWS\system32\mouse_configurator.win
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Popup Manager - {08E74C67-99A6-45C7-94DA-A397A8FD8082} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Kernel32] C:\WINDOWS\system32\Kernel32.win
O4 - HKLM\..\Run: [Israfel] C:\WINDOWS\system32\Israfel.vbs
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: blueyonder Instant Support Tool.lnk = C:\Program Files\blueyonder IST\bin\matcli.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar3.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar3.dll/cmwordtrans.html
O8 - Extra context menu item: ActiveCheckout - about:new ActiveXObject("SSInstall.Installer").RunSunshine();
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar3.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar3.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar3.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar3.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.[....]rear_window.html?noreloadredir
O16 - DPF: {26CBF141-7D0F-46E1-AA06-718958B6E4D2} - http://download.ebay.com/turbo_lister/UK/install.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.snapfish.co.uk/SnapfishUKActivia.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com[....]sengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: PAVWAIT.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

[addsig]

Joined: Nov 24, 2004
Posts: > 500
From: Manchester (@ Uni)
PM

Posted: 2006-02-27 19:03

ne1 help

my pc keeps doin dodgey things like outlook keeps opening n i cant shut a message down,

[addsig]

Joined: Nov 30, 2003
Posts: > 500
From: England
PM, WWW

Posted: 2006-02-27 19:11

These two need to go, viruses!

F0 - system.ini: Shell=Explorer.exe C:\\\\WINDOWS\\\\system32\\\\winmgd.win
F1 - win.ini: run=C:\\\\WINDOWS\\\\system32\\\\mouse_configurator.win

And this:

O4 - HKLM\\\\..\\\\Run: [Israfel] C:\\\\WINDOWS\\\\system32\\\\Israfel.vbs

Write down the file names and locations on a bit of paper, eg. c:\\windows\\system32\\winmgd.win, and reboot in safe mode.

Navigate to each file and delete it. Reboot in normal mode and run hijack this again to make sure they've gone.

They might be hidden files, so make sure you've got 'show hidden files and folders' and 'show system files' checked in 'folder options' under the 'tools' menu.

Joined: Nov 24, 2004
Posts: > 500
From: Manchester (@ Uni)
PM

Posted: 2006-02-27 19:20

Quote:

On 2006-02-27 19:11:37, Cycovision wrote:

O4 - HKLM\\..\\Run: [Israfel] C:\\WINDOWS\\system32\\Israfel.vbs

Write down the file names and locations on a bit of paper, eg. c:\windows\system32\winmgd.win, and reboot in safe mode.

Navigate to each file and delete it. Reboot in normal mode and run hijack this again to make sure they've gone.

i've done the 1st bit you asked but i don't get the bit above. which file names and locations ? all of the ones listed ?

edit: and Thanks

really do appreciate it

_________________
My Ebay Items (Check My ME page out)

[ This Message was edited by: max99 on 2006-02-27 18:21 ]

Joined: Nov 30, 2003
Posts: > 500
From: England
PM, WWW

Posted: 2006-02-27 19:35

Yes, the two .win and one .vbs files

Joined: Nov 24, 2004
Posts: > 500
From: Manchester (@ Uni)
PM

Posted: 2006-02-27 20:17

done

but files werent there in safe mode to delete, so im guessin they hav gone ? [addsig]

Joined: Nov 30, 2003
Posts: > 500
From: England
PM, WWW

Posted: 2006-02-27 20:23

Well, have another hijack this and see of those three entries have gone

Sometimes viruses generate temporary files or files that change name periodically.