system
July 16, 2008, 5:42am
1
Dear Room,
I’ve try to scan using Avast boot scan, Kaspersky Online scanner, Panda Active Scan 2.0, but cannot found any virus in my computer.
pls help me, my internet charges is based on quota…
here’s the hijackthis report.
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
BR,
system
July 16, 2008, 5:42am
2
continue of Hijackthis
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blankhttp://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
–
system
July 16, 2008, 7:47am
3
turn off auto update anti virus avast
This looks suspicious:
O20 - Winlogon Notify: iifcddbx - C:\WINDOWS\
Is there such a file in C:\WINDOWS\ and are you able to submit it to VirusTotal
You may need to disable ‘Hide protected operating system files’ ‘View Hidden Files and Folders’
Post the analysis here if you find it.
I’d recommend a few anti-spyware scans to see if they pick it up:
Ad-Aware Free Spybot Search & Destroy SUPERAntiSpyware Free Malwarebytes’ Anti-Malware
system
July 16, 2008, 8:44am
5
forgot to mention, I’ve also scanning using malwarebytes but cannot find any suspicious.
and I cannot locate the iifcddbx file. try using the search also give no result.
then I try the Winlogon.exe upload to virustotal, and give zero result out of 33.
Have you tried fixing this entry with HijackThis!?
O20 - Winlogon Notify: iifcddbx - C:\WINDOWS\
system
July 16, 2008, 6:54pm
8
This is just a guess on my part, but, do you or have you ever connected an iPod or similar device (mp3 player, etc) to your computer?
system
July 16, 2008, 7:06pm
9
Good guess CharleyO!
yes! as long as I can remember, the problem occur when I lent Iphone from my friend 2 weeks ago.
how to fix it? just uninstall the iTune program? I’ve done it but the internet still sending and receiving.
or because I upgrade the Mozilla browser to 2.0.0.15? I just trying that if I use IE, the autonomy sending & receiving activity is lesser.
thx
system
July 16, 2008, 10:50pm
10
Though you are not likely to find much for the exact file name Frank was wanting you to fix using HJT … O20 - Winlogon Notify: iifcddbx - C:\WINDOWS\ … is a type of file used by such devices such as iPods, iPhones, etc. The clue is the cddbx part of the entry. Have you fixed this by using HJT yet? If not, I think you should.
OR , maybe first you should uninstall the iTunes program through Add/Remove Programs and then run HJT once again to see if the entry is still there. If it is, then use HJT to fix it.
system
July 17, 2008, 5:34pm
11
Hai,
I’ve fixed the o20, but the activity of sending and receiving still occur.
here’s the updated hijackthis log:
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
----continue
system
July 17, 2008, 5:35pm
12
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll@xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
–
