system
March 17, 2009, 11:53am
1
Hi guys,
File name: C:\Documents and Settings\Pettenon\Local Settings\Temporary Internet Files\Content.IE5\MPPEVZMD\gg[1].exe
And the second one
Ive deleted my temp files and they still come back. Thanks for the help in advance
DavidR
March 17, 2009, 4:11pm
2
If it keeps coming back, there is likely to be an undetected or hidden element to the infection that restores or downloads the file again. What is your firewall ?
If you haven’t already got this software (freeware), download, install, update and run it, preferably in safe mode and report the findings (it should product a log file).
system
March 17, 2009, 9:26pm
3
thanks mate for the response. i’ll download the software and do scan and ill let you know the results at a later time. Thanks again
system
March 18, 2009, 11:34am
5
Hi again thanks for the help. So i downloaded some of the software you suggested and done some scanning. My computer seems fairly good, no Trojan alerts from avast for now.
Here is my HJT log,
Running processes:
system
March 18, 2009, 11:38am
6
And the final part of the log,
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)@xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
–
;D Thanks again for the quick help. All my software do not detect any infections which is great. You guys are brilliant. ;D
system
March 18, 2009, 11:55am
7
**UPDATE: Ive gotten rid of some stuff. This is my most recent log. I have already analyzed it on the internet but if anyone wants to double check it’ll be much appreciated. Thankss
C:\WINDOWS\System32\smss.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157
I hope some expert could continue helping you with this HijackThis log.
DavidR
March 18, 2009, 2:43pm
9
Don’t edit the logs, e.g. chop the header information, that helps us also.
Ensure you have the latest version of JRE (JAVA Runtime Environment) because older versions can be vulnerable to malware and yours is well out of date. First remove All Older Versions From Add/Remove Programs.
Then get the latest update from here http://java.sun.com/javase/downloads/index.jsp
Or JRE version 6 update 12 http://www.majorgeeks.com/Sun_Java_Runtime_Environment_d4648.html
Acrobat pdf reader is also out of date and there have been a number of security updates closing vulnerabilities.
So considering your form for having out of date applications ;D I would also suggest a visit to this site, which scans your system for out of date programs that have patches to close vulnerabilities, http://secunia.com/software_inspector/ .
Bonjour is considered by many as a) unnecessary and b) unwanted.http://www.liutilities.com/products/wintaskspro/processlibrary/mdnsresponder .
How To Uninstall or Remove Bonjour mDNSResponder.exe
Also see www.serophos.net/au-revoir-bonjour for a tool to automate this process so you don’t have to manually remove as in the above link.
You don’t appear to have an active firewall - It should be capable of blocking unauthorised outbound Internet Connections. - What is your firewall ?
Other than that I don’t see anything obvious.
system
March 18, 2009, 6:02pm
10
In the last HJT posting, no header and no end. These are important.
system
March 19, 2009, 6:13am
11
Here is the latest HJT log
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
–
Umm i think i got rid of Bonjour, I’m not too worried about it honestly. Got around to updating some programs etc.
system
March 19, 2009, 7:03am
12
Hi Jaydos,
That is a good clean HJT log.
As for a firewall, I would suggest ZA Free. Others will suggest PC Tools, Comodo, and many more.
system
March 19, 2009, 9:01am
13
Ok mate thanks a lot for your help, i really appreciate it.
DavidR
March 19, 2009, 2:26pm
14
You’re welcome.
Just take care when downloading and installing Zone Alarm, ensure that it is the free version as they will try and a) have you download the free version (with trial elements of the pro version) and when you install if there is an option to install trial elements, decline and select only the free version.
The reason I mention this is that the ZA Pro versions privacy function can interfere with the avast web shield.
system
March 19, 2009, 5:01pm
15
You are welcome … glad to help.
system
March 19, 2009, 11:20pm
16
@DavidR : Yes i was sure that i downloaded only the free version, no trials or any of that crap. I’m quite glad i downloaded ZA, it seems like a good program. I’ll definitely be back on this forum even if i dont have any problems, you guys are a good bunch o people .
system
March 19, 2009, 11:38pm
17
You are welcome, Jaydos.
Please come back often, learn more, and maybe help others.
