Here is the first scan that I did when it was namws HiJackThis:
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.audiodrome.net/indexholder.html http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://webplayer.unity3d.com/download_webplayer-2.x/UnityWebPlayer.cab http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1229190067328 http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1230047109531
–
Here is the second scan I did after renaming it:
Logfile of Trend Micro HijackThis v2.0.2
Running processes:C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\WINDOWS\system32\wuauclt.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.audiodrome.net/indexholder.html http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://webplayer.unity3d.com/download_webplayer-2.x/UnityWebPlayer.cab http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1229190067328 http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1230047109531
–
I noticed that there were two new items found in the second scan which are highlighted in bold. Are they anything to be concerned about?
these two things are Windows update and Adobe reader speed launcher… both legit…
Thanks. That’s what I thought, but now my computer is going crazy and I’m starting to worry that in my zeal to protect my computer I may have actually screwed it up more. This morning I installed a few more things to make sure I was up to date on everything security-wise. The trouble started when I uninstalled Adobe Reader 7 and tried to install Adobe Reader 9. It went through the whole installation process adding a third party Service Pack (Hyperion VIA) and then I rebooted but there was no sign of it ever being installed. I tried again and it was the same thing. When I searched for “adobe” using the new Windows Search 4.0 that I just installed the search results were all screwed up. In fact it listed two items that could not be previewed and they were the same two items that HiJackThis found in the second scan (is that weird?). So, I uninstalled Windows Search and after rebooting, my taskbar shortcut icons disappeared! So then I tried to do a System Restore from two days ago and it wouldn’t let me (I had to disable this on the 2nd to do the virus scan so that’s the earliest restore point I could try). This was the same problem I had when I was infected last week, so now I don’t know what’s going on! :wacko:
system
January 5, 2009, 8:40pm
5
I wonder IF you correctly renamed “HijackThis.exe” because in your 2nd Scan
Now type Crusty.exe into the title box and hit the enter key. Right click on the Crusty.exe file and choose “Send to desktop Create Shortcut”.
You can now close the HJT directory.
You’re right. I only renamed the shortcut. All this stuff is frying my brain!
Here are the two new scans:
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.audiodrome.net/indexholder.html http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://webplayer.unity3d.com/download_webplayer-2.x/UnityWebPlayer.cab http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1229190067328 http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1230047109531 http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/jre/6u11-b90/jinstall-6u11-windows-i586-jc.cab?e=1231177696450&h=f6a95e2bec2f7c7b9e1d4f2776bf19e1/&filename=jinstall-6u11-windows-i586-jc.cab
Scan 1 Continued:
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
–
Scan 2:
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.audiodrome.net/indexholder.html http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://webplayer.unity3d.com/download_webplayer-2.x/UnityWebPlayer.cab http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1229190067328 http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1230047109531 http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/jre/6u11-b90/jinstall-6u11-windows-i586-jc.cab?e=1231177696450&h=f6a95e2bec2f7c7b9e1d4f2776bf19e1/&filename=jinstall-6u11-windows-i586-jc.cab
–
The only thing that I found different was C: Windows\system32\wuauclt.exe. The other suspicious line is now gone because I uninstalled Adobe Reader. I tried to install Version 9 but it went through the whole installation and after reboot, it never installed. I tried it again and it still wouldn’t install, but it didn’t give me any error messages or anything. Is my spyware stopping it from installing?
DavidR
January 5, 2009, 10:52pm
10
That is a part of the windows update process.
http://www.liutilities.com/products/wintaskspro/processlibrary/wuauclt/
wuauclt.exe is a process managing automatic updates for Microsoft Windows. This process continuously checks for the latest updates and uses the Internet to ...
polonus
January 5, 2009, 11:10pm
11
Hi audiodrome,
Follow the instructions as given to the dot, you are not to experiment with ddls and processes you don’t know about if they are legit or malicious.
DavidR is right here , you are not to kill or remove this wuauclt.exe , it is vital for your Microsoft updating process,
polonus
I didn’t touch anything. The “Adobe” line disappeared when I uninstalled Adobe Reader.
Hi :