Trojans Again

Discussion in 'Offtopic Discussions' started by DemonStar55, Feb 26, 2005.

  1. DemonStar55

    DemonStar55 chai chai chai chai chai chai chai chai chai chai

    Joined:
    Nov 24, 2003
    Messages:
    1,889
    Location:
    Wrentham, MA
    well my sisters are experts at gettign trojans so I need some help again

    Logfile of HijackThis v1.99.1
    Scan saved at 11:30:44 PM, on 2/25/2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\LiteStep\litestep.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
    c:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Eset\nod32krn.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
    C:\WINDOWS\System32\igfxtray.exe
    C:\WINDOWS\System32\hkcmd.exe
    c:\PROGRA~1\NORTON~1\navapw32.exe
    C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
    C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
    C:\Program Files\Eset\nod32kui.exe
    C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
    C:\Documents and Settings\Owner\Desktop\Mike's Zone\FreeRAM XP Pro 1.40.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\Microsoft Broadband Networking\MSBNTray.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\d3eg32.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Owner\Desktop\Mike's Zone\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Exploader
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    O4 - HKLM\..\Run: [CamMonitor] c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [NAV Agent] c:\PROGRA~1\NORTON~1\navapw32.exe
    O4 - HKLM\..\Run: [Iomega Startup Options] C:\Program Files\Iomega\Common\ImgStart.exe
    O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [KernelFaultCheck] C:\WINDOWS\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
    O4 - HKLM\..\Run: [checktime] c:\program files\HPSelect\Frontend\ct.exe
    O4 - HKCU\..\Run: [Iomega Active Disk] C:\Program Files\Iomega\AutoDisk\AD2KClient.exe
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [FreeRAM XP] "C:\Documents and Settings\Owner\Desktop\Mike's Zone\FreeRAM XP Pro 1.40.exe" -win
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Forget Me Not.lnk = C:\Program Files\Broderbund\AG CreataCard\AGRemind.exe
    O4 - Global Startup: Microsoft Broadband Networking.lnk = ?
    O4 - Global Startup: Shortcut to TeaTimer.lnk = C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O15 - Trusted Zone: *.frame.crazywinnings.com
    O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
    O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200404...meInstaller.exe
    O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/ac...ta/SymAData.cab
    O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/ac.../ActiveData.cab
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O23 - Service: Iomega Activity Disk2 - Iomega Corporation - C:\PROGRA~1\Iomega\System32\ActivityDisk.exe
    O23 - Service: IomegaAccess - Iomega Corporation - C:\WINDOWS\System32\IomegaAccess.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: NOD32 Kernel Service (NOD32krn) - Unknown owner - C:\Program Files\Eset\nod32krn.exe
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2004\WinStylerThemeSvc.exe
    O23 - Service: ZipToA - Iomega Corporation - C:\WINDOWS\System32\ZipToA.exe
    O23 - Service: Remote Procedure Call (RPC) Helper ( 6QÔõ'ª´ÆÐ8) - Unknown owner - C:\WINDOWS\d3eg32.exe



    I ran it through hijackthis.de but every time I open something in explorer it gets back on
     
    Tags:
  2. trooper

    trooper Trooper`s watching you !!!

    Joined:
    Apr 20, 2003
    Messages:
    5,503
    Location:
    The DarkSide (London)
    Don`t really know how to decipher that listing, But have you got a firewall installed, Or at least enabled the built-in XP one ?.

    **Looks over shoulder to see if Rico is watching**

    Trooper
     
  3. DemonStar55

    DemonStar55 chai chai chai chai chai chai chai chai chai chai

    Joined:
    Nov 24, 2003
    Messages:
    1,889
    Location:
    Wrentham, MA
    I belive it is and the one in the router too

    okay I belive it is called win32/TrojanDownloader.NBS or something and when remove it w/ nod32 another one comes up w/ a different set of last 3 letters
     
  4. Titcher

    Titcher Active Member

    Joined:
    Nov 10, 2003
    Messages:
    538
    Restart the computer in safe mode, go to run and run msconfig, disable all the trojans starting up, gives you a chance to delete them from the hard drive.
     
  5. DemonStar55

    DemonStar55 chai chai chai chai chai chai chai chai chai chai

    Joined:
    Nov 24, 2003
    Messages:
    1,889
    Location:
    Wrentham, MA
    how do i know which programs are the trojans?
     
  6. Titcher

    Titcher Active Member

    Joined:
    Nov 10, 2003
    Messages:
    538
    This one looks alot like it could be C:\WINDOWS\d3eg32.exe It's just a matter of you looking to see if it's something you use, if not, delete it.
     
  7. Steve-O

    Steve-O Very Active Member

    Joined:
    Aug 28, 2003
    Messages:
    4,054
    Run Anti Vir...

    How the hell do trojans get onto a PC anyway?? Can it be something simple like visiting a web site??

    I get atleast 2 trojans a week :(
     
  8. Rico

    Rico Certified Guru

    Joined:
    Apr 4, 2003
    Messages:
    5,649
    Location:
    England, UK
    Definitely C:\WINDOWS\d3eg32.exe although first 4 letters are probably random. "Restart the computer in safe mode, go to run and run msconfig, disable all the trojans starting up, gives you a chance to delete them from the hard drive." < do that.

    Steve-O, start using Firefox and make sure Windows is fully updated.
     
  9. Bingo Jesus

    Bingo Jesus GP2X Hardcore

    Joined:
    Jun 25, 2004
    Messages:
    384
    Location:
    Cumbria, UK
    Run the log file though this.

    I ran yours though it and it said that,

    The rest were all safe.
     
    Last edited by a moderator: Dec 18, 2015
  10. DemonStar55

    DemonStar55 chai chai chai chai chai chai chai chai chai chai

    Joined:
    Nov 24, 2003
    Messages:
    1,889
    Location:
    Wrentham, MA
    yeah I need to do the msconfig thing

    and we don't use IE anymore but Im not sure if my sisters still do but if they do I will kill them
     
  11. trooper

    trooper Trooper`s watching you !!!

    Joined:
    Apr 20, 2003
    Messages:
    5,503
    Location:
    The DarkSide (London)
    Get a 486 or pentium 1 computer stick windows 98 on and let them use that. :p

    Problem solved. :D

    Trooper
     
  12. Thyphoid

    Thyphoid Member

    Joined:
    Jul 31, 2003
    Messages:
    194
    Location:
    Germany
    Use Linux for all Internet activity.
     
  13. Nilsiboy

    Nilsiboy 1337 T045T

    Joined:
    Jul 9, 2004
    Messages:
    557
    you dont mean service pack 2 do you?
    makes programs not work....and games...and makes opening downloaded files sooo complicated....it's EVUL
    i dont have it and dont have any trojans either, although I'm sometimes visiting .... lets say dangerous sites
     
    Last edited by a moderator: Feb 3, 2016
  14. Steve-O

    Steve-O Very Active Member

    Joined:
    Aug 28, 2003
    Messages:
    4,054

    yea I use Firefox, But have never updated Windows since 2002 I think :p LOL

    do I realy have to update windows as my windows xp has a bad cd key if you know what I mean :)

    and the last time I tried to update windows I have to reformat :(
     
    Last edited by a moderator: Feb 3, 2016
  15. aapje89

    aapje89 Still here...

    Joined:
    Jun 12, 2004
    Messages:
    2,753
    Location:
    The Netherlands
    ooooh :eek: LOL, get a decent firewall and virus scanner (antivir, zone alarm), then youll have no problems
     
    Last edited by a moderator: Feb 3, 2016
  16. trooper

    trooper Trooper`s watching you !!!

    Joined:
    Apr 20, 2003
    Messages:
    5,503
    Location:
    The DarkSide (London)
    Or at least a key that works with WU. ;)

    Trooper
     
    Last edited by a moderator: Feb 3, 2016
  17. Thyphoid

    Thyphoid Member

    Joined:
    Jul 31, 2003
    Messages:
    194
    Location:
    Germany
    If you have a "old" CD-Key, not capable installing SP2 you can "register" your windows again and enter a new key that is functional. Modding tutorials for the Registry here. The Registry is changed and Windows starts the Activation-Wizard again, then you can enter a "new" CD-Key. Update your Windows, not only for your own sake.
     
    Last edited by a moderator: Feb 3, 2016
  18. bast525

    bast525 Well-Known Member

    Joined:
    Dec 4, 2004
    Messages:
    1,653
    I notice lots of people mention Anti Vir, and Zone Alarm... I actually bought a copy of Macafee a while ago and am subscribed to get virus updates regularly, but no one ever recommends macafee... is it just useless or what?
     
  19. Steve-O

    Steve-O Very Active Member

    Joined:
    Aug 28, 2003
    Messages:
    4,054
    well, Currently Im using Anti Vir, Sygate Pro, Microsoft Spyware scanner thing, Spybot and Adaware...

    I have had no problems so seen as its all working Im not gonna touch it :)
     

Share This Page

Loading...