TheTechGuide Forum

General Category => Tech Clinic => Topic started by: Guest_Alex_* on February 04, 2005, 07:02:24 PM

Title: hijacked PC
Post by: Guest_Alex_* on February 04, 2005, 07:02:24 PM

Hi,

I hope someone can help me ...my PC was hijacked by a Trojan Horse.  I have XP Home Edition.  I used severeal tools including Hijack This 1.99.00.
The trojan is gone (looks like) ... but the "C:\Windows\Downloaded Programs Files" displays no files in it, although there are 2 files in it that I can see going into the directory from the command prompt.
One of those files is "Yahoo! Hearts.osd" and the other one is "desktop.ini" (they both have the A attribute on).
How can I get this files to be ssen from the Explorer ?
I am still having some kind of trojan or spyware file in the system ?

Title: hijacked PC
Post by: guestolo on February 05, 2005, 02:33:00 AM

Can you Download Hijackthis 1.99
A small utility to help identify if any Hijackers, Malware, Spyware, etc.....Reside on your computer

Important: Create a Permanent folder for Hijackthis
Double Click "MY Computer"
Open your C: drive
Click "File" >>> "New" >>>> "Folder"
A new folder will be created, name it HJT

Now you will have C:\HJT

Download Hijackthis from CLICK HERE (http://\"https://ssl.perfora.net/tools.radiosplace.com/HijackThis.exe\") or CLICK HERE (http://\"http://aumha.org/downloads/hijackthis.exe\")
Save it to that new folder

Do a SCAN and Save a Log file---Save the log----copy and paste the WHOLE contents of the log  here... Don't try and fix anything yet----ICt is all important

Title: hijacked PC
Post by: Guest_Alex_* on February 05, 2005, 01:30:55 PM

First of all, thanks a lot for responding.
Here es the log from Hijack 1.99

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = ""
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [hp Silent Service] C:\Windows\system32\HpSrvUI.exe
O4 - HKLM\..\Run: [CamMonitor] c:\Archivos de programa\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\ARCHIV~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\ARCHIV~1\Grisoft\AVGFRE~1\avgemc.exe
O16 - DPF: Yahoo! Hearts - http://download.games.yahoo.com/games/clients/y/ht1_x.cab (http://\"http://download.games.yahoo.com/games/clients/y/ht1_x.cab\")
O17 - HKLM\System\CCS\Services\Tcpip\..\{79926079-08A5-4696-B18D-D8526873D248}: NameServer = 200.33.146.194,200.33.146.202
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Servicio del administrador de discos lógicos - Unknown - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Registro de sucesos - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: Servicio COM de grabación de CD de IMAPI - Unknown - C:\WINDOWS\System32\imapi.exe
O23 - Service: InterBase Guardian - Inprise Corporation - C:\Archivos de programa\Borland\InterBase\bin\ibguard.exe
O23 - Service: InterBase Server - Inprise Corporation - C:\Archivos de programa\Borland\InterBase\bin\ibserver.exe
O23 - Service: Escritorio remoto compartido de NetMeeting - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: DDE de red - Unknown - C:\WINDOWS\system32\netdde.exe
O23 - Service: DSDM de DDE de red - Unknown - C:\WINDOWS\system32\netdde.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: OracleOraHome9ClientCache - Unknown - C:\Oracle\Ora90\BIN\ONRSD.EXE
O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: Administrador de sesión de Ayuda de escritorio remoto - Unknown - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Sistema de ayuda de tarjeta inteligente - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Tarjeta inteligente - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Registros y alertas de rendimiento - Unknown - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Instantáneas de volumen - Unknown - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Adaptador de rendimiento de WMI - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

Title: hijacked PC
Post by: guestolo on February 07, 2005, 12:56:06 AM

Sorry for the delay, I need to see the whole log

Please run another fresh scan
The log that open in Notepad click EDIT>>SELECT ALL
Right click and copy the whole selection

Paste it back here