system
November 20, 2007, 7:37am
1
hi im new to all this so i hope this makes some sense to you all , not to sure where to start but i’ll have a go and hopefully it will make sense to someone…
c:windows\system\drivers\ip6fw.sys win32:agent-KIR
c:windows\system32\applayerd.exe win32.ircBOT-CHR
all in the quarantined chest. also when connected on line i keep getting the on access scanner message warning trojan found abort connection malware name Win32:small-EPJ (trj) every couple of seconds
system
November 20, 2007, 10:15am
2
hi and welcome , Whoever told you to use one AV was right, you need to make a choice then uninstall one.http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php?page=download
system
November 20, 2007, 1:36pm
3
ahh but which one avast found problems that macafee didnt as well as the trojan threats on the on access scanner that macafee didnt yet macafee does all my spam mail and firewall .anyone have any thoughts on this please ?http://www.virginmedia.com/ http://www.club-vaio.sony-europe.com @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)http://www.club-vaio.sony-europe.com http://symantec.atgnow.com/sdccommon/download/tgctlsi.cab http://symantec.atgnow.com/sdccommon/download/ssrc.cab http://go.microsoft.com/fwlink/?linkid=39204 http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1126799523101 http://chat.yahoo.com/cab/yacsui.cab http://www.gamehouse.com/games/dvcode/DVCControl.cab http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
hope it makes sense to you lot
system
November 20, 2007, 7:26pm
4
That gives us somewhere to start but your log is missing a large portion and its an old obsolete version so it would be a good idea to uninstall it and get the one from the link I supplied.
from what is there It appears you have good things on your system and bad, one bad one is SPYWAREBOT This is actually a Rogue program which probably brought you all the grief.http://www.spywarewarrior.com/rogue_anti-spyware.htm#products
system
November 20, 2007, 8:17pm
5
log from new hijackthis
Running processes:
system
November 20, 2007, 8:18pm
6
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virginmedia.com/ http://www.club-vaio.sony-europe.com @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://www.club-vaio.sony-europe.com http://symantec.atgnow.com/sdccommon/download/tgctlsi.cab http://symantec.atgnow.com/sdccommon/download/ssrc.cab http://go.microsoft.com/fwlink/?linkid=39204 http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1126799523101 http://chat.yahoo.com/cab/yacsui.cab http://www.gamehouse.com/games/dvcode/DVCControl.cab http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
–
system
November 20, 2007, 10:41pm
7
superantispyware log hope this helps
SUPERAntiSpyware Scan Loghttp://www.superantispyware.com
Generated 11/20/2007 at 10:37 PM
Application Version : 3.9.1008
Core Rules Database Version : 3347
Scan type : Complete Scan
Memory items scanned : 572
Unclassified.SpywareBot (Not A Threat)
DavidR
November 20, 2007, 11:44pm
8
SpywareBot seems to have a dubious rep, did you install this believing it was a genuine anti-spyware ?http://www.bleepingcomputer.com/startups/SpywareBot.exe-15495.html and http://www.spywarewarrior.com/rogue_anti-spyware.htm , see image.
Did you allow SAS to deal with what it found ?
You also seem to have remnants of Symantec and also McAfee AV element.
I suggest that you uninstall the McAfee security suite, reboot and do a custom install excluding any antivirus element.
A link worth looking at, which is a program removal tool that can remove the remnants of a number of different Norton Programs:Removing your Norton program using SymNRT SymNRT, a Norton uninstall tool that uninstalls all Norton 2004/2005/2006 products.
Once you have done that post a fresh HJT log.
system
November 21, 2007, 9:39am
9
unfortunately yes i installed it thinking it was genuine antispyware , SAS if i remember deleted some and quarantined others.i ran the norton removal tool but loking in the programe bar for the antivirus setup its a 2002 version which the removal tool didnt touch. are there ones that will? also do i leave spywarebot or delete it now?
system
November 21, 2007, 4:28pm
11
as requested macafee now nolonger antivirus ,that part not installed .ran the remover on nortons as instructions hopes this helps
Running processes:
system
November 21, 2007, 4:29pm
12
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virginmedia.com/ http://www.club-vaio.sony-europe.com @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://www.club-vaio.sony-europe.com http://symantec.atgnow.com/sdccommon/download/tgctlsi.cab http://symantec.atgnow.com/sdccommon/download/ssrc.cab http://go.microsoft.com/fwlink/?linkid=39204 http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1126799523101 http://chat.yahoo.com/cab/yacsui.cab http://www.gamehouse.com/games/dvcode/DVCControl.cab http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
–
DavidR
November 21, 2007, 5:39pm
13
FIX:
It still looks like you have remnants of Symantec.
http://www.auditmypc.com/process/symlcsvc.asp
symlcsvc.exe (Sym LC Service) - Details
The symlcsvc.exe process is a core component of Norton Internet security and is required for Norton products to function correctly. If this process is stopped, Norton Internet security will not be able to effectively protect your computer, and you run the risk of being infected by viruses, trojans and other malware.
symlcsvc.exe is an application that does NOT appear to be a security risk
The Process Server database currently registers symlcsvc.exe to Symantec.
This is part of Norton Internet Security.
system
November 21, 2007, 9:15pm
14
hjt log after fix on 02
Running processes:
system
November 21, 2007, 9:16pm
15
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virginmedia.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://www.club-vaio.sony-europe.com http://symantec.atgnow.com/sdccommon/download/tgctlsi.cab http://symantec.atgnow.com/sdccommon/download/ssrc.cab http://go.microsoft.com/fwlink/?linkid=39204 http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1126799523101 http://chat.yahoo.com/cab/yacsui.cab http://www.gamehouse.com/games/dvcode/DVCControl.cab http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
–
system
November 21, 2007, 9:19pm
16
sorry did you want me to fix O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe as well?
DavidR
November 21, 2007, 10:00pm
17
I don’t see anything else obvious in the log are you noticing that feel is strange, etc. ?
Ensure you have the latest version of JRE (JAVA Runtime Environment) because older versions can be vulnerable to malware, yours is one update out. First remove All Older Versions From Add/Remove Programs.
Then get the latest update from here http://www.java.com/en/download/index.jsp
Or JRE version 6 update 3 http://www.majorgeeks.com/Sun_Java_Runtime_Environment_d4648.html
Personally I would fix the O23 symantec entry as effectively you don’t have it installed and the purpose of the removal tools was to remove these remnants.
system
November 21, 2007, 10:33pm
18
ive just looked yes its still there. by just removeing 023 that will get rid of it all? oh and im guessing that i should delete spywarebot too?.. i must admit i havent run avast since monday i think but i will and see if any thing is picked up once you let me know what to do with spywarebot and then i’ll go back to using spybot search aand destroy if you think that would be wise
DavidR
November 21, 2007, 11:53pm
19
Removing the O23 entry may not get rid of the file but at least it won’t be running, you can delete the file after a while if there is no issue with the removed entry which I doubt.
Yes remove the remaining spywarebot.
Personally I feel spybot S&D is a bit lightweight now, SuperAntiSpyware would be a better bet, but there would be no problem having S&D as another on-demand anti-spyware scanner.
You don;t have to run avast as it is a resident scanner so if there is an ‘active’ problem then avast should alert you. I just do a weekly on-demand scan with avast and then only Standard sensitivity without archives.
system
November 23, 2007, 11:09am
20
ok i will remove them both the only problem i seem to be geting now is on start up i gat a message that : windows cannot open this file. file : palstart.ink.disabled.
fingers crossed