system
March 30, 2008, 2:21pm
1
I think i may be infected but avsat! , nod32 , superantispyware, spybot scans can’t find anything. Therefore, my firewall (comodo 2.4) blocks 2 or 3 outgoing connections every second :o :o each connection is going to a different adress…
This is my log :
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
system
March 30, 2008, 2:22pm
2
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157
system
March 30, 2008, 2:23pm
3
O4 - Global Startup: Logitech SetPoint.lnk = ?@xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://go.microsoft.com/fwlink/?linkid=39204 http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1129120660046 http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab https://motive.club-internet.fr:8080/lwp/static/installers/WebflowActiveXInstaller_4-0-0.cab
–
thanks for your help
cvsa, aren’t you using NOD32 as the resident?
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Fichiers communs\DataViz\DvzIncM sgr.exe: *** POSSIBLE THREAT: DvzIncMsgr.exe - “Installed with DataViz ““Documents to Go”” software”.
O20 - AppInit_DLLs:O20s are usually (not always) malicious and should be fixed.
system
March 30, 2008, 2:42pm
5
I was using nod 32 amon as resident (and disabling avsat standard shield) and it use to work well but since last 4.8 version, i get nod32 heuristic alerts when downloading a file, cause avast is creating a temp file in c:\windows\temp\avast4 and this file is sent to nod 32 quarantine… i tried to exclude this folder ans ashserv.exe in nod32 but the problem still remains.
Finally, i desactivated nod32 resident and restored avast standard shield normal settings ;D ;D
Did you try on-line scanning?
system
March 30, 2008, 2:54pm
7
no, i did scan with 2 antivirus, and avast! i guess it’s enough :-\
deleting 020 entry “SASwinlogon” (superantispyware) seems to have solved partially the problem ( 1 attempt to connect only every 5 sec)
time to wonder what’s behind superantispyware…
I’ll disable it (with autoruns) to test.
The 020 is normal with SAS on the computer.
These lines can be fixed as they are not loading anything
F3 - REG:win.ini: load=
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
Some info on the above line
“If this was set by a LAN Adminitrator do not fix it, ask him/her first. Fixing this 06 items will reset the Control Panel Menu options which were probably disabled when Spybot and Destroy was installed”
system
March 30, 2008, 3:38pm
10
ok thx , sas is of course normal but was trying to connect to the internet every second wich is not really cool !
I’ve never come across this with SAS. It is a legitamate entry. Do you have automatic updates turned?
This however, may be showing a hidden entry. It is a list of .dlls set to load at log on, but no file name(s) are shown.
O20 - AppInit_DLLs:
system
March 30, 2008, 7:20pm
12
Many thanks for your help.
BTW I found a very useful site to evaluate hijackthis logs :
http://hijackthis.de/index.php?langselect=french
DavidR
March 30, 2008, 8:52pm
13
It only gives a good start point, but you shouldn’t take things as gospel, there are many things which are reported as safe that aren’t. You have to look deeper than the analysis, using google for the file names, etc.
But you can disable the driver. SuperAntispyware seems to work fine without the startup entry.
Yes, but I’ve never had anyone say that it was attempting to connect to the internet. This is the free version I’m refering to. I’ve got it and the only time it tries is when I click update.
That’s what I find strange. Plus he said it solved part of the problem.
>:(
